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PREFACE 


This  study  is  sponsored  by  the  Federal  Aviation  Administration  and  is  directed 
toward  the  improvement  of  flight  crew  performance  through  the  development  of 
standardized  aircraft  alerting  systems  for  crew  alerting  and  monitoring  of 
flight  status.  Previous  studies  suggested  that  a  flight  status  monitor  (FSM) 
could  monitor  flight  status  for  abnormal  operations  as  well  as  aircraft  system 
failures  and  could  guide  the  crew  through  the  appropriate  procedures  for  the 
situation.  The  objective  of  this  study  is  to  develop  and  evaluate  FSM 
concepts. 

This  report  covers  the  design,  test,  and  evaluation  of  flight  status  monitor 
concepts  conducted  under  FAA  Contract  DTFA01-83-C-20033,  “Flight  Phase  Status 
Monitor  Study".  The  report  summarizes  both  Phase  I  and  Phase  II  efforts. 
Phase  I  developed  and  made  preliminary  evaluations  of  FSM  concepts.  Phase  II 
consisted  of  refining  and  evaluating  the  relative  effectiveness  of  several 
candidate  concepts. 


The  authors  wish  to  express  their  appreciation  for  the  assistance  received 
from  their  respective  organizations.  The  assistance  and  guidance  of  Wayne  D. 
Smith,  the  Program  Manager  and  Manager  of  Boeing  Flight  Deck  Research,  was  of 
great  value.  The  contract  sponsor  is  the  Federal  Aviation  Administration,  and 
technical  guidance  was  provided  by  William  F.  Petruzel ,  and  William  F.  White, 
APM-430,  the  Contract  Monitors. 
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1.0  INTRODUCTION 


1.1  Background 

The  study  of  aircraft  alerting  systems  and  flight  status  monitor  concepts  was 
initiated  in  1973  when  the  Federal  Aviation  Administration  (FAA)  contracted 
with  Boeing  to  study  independent  altitude  monitors.  Follow-on  studies 
conducted  during  1974  through  1977  investigated  operational  philosophies  for 
implementing  effective  and  reliable  alerting  systems.  Study  results  indicated 
that  there  had  been  a  significant  increase  in  the  number  of  alerting  signals 
used  on  newer  commercial  transports  and  very  little  standardization  had  been 
used  by  the  airframe  manufacturers  in  implementing  alerting  system  elements. 
Table  1.1-1  summarizes  the  major  activities  accomplished  during  these  studies. 

The  identification  of  these  problems  led  to  the  Aircraft  Alerting  Systems 
Standardization  Study  contract.  The  contract  was  performed  as  a  team  effort 
by  the  Boeing,  Lockheed  and  McDonnell  Douglas  aircraft  companies.  The  study 
was  to  have  been  conducted  in  three  phases  and  culminate  with  the  development 
of  design  guidelines  for  improving  and  standardizing  advanced  aircraft 
alerting  systems.  During  the  course  of  the  study  contract,  however,  interest 
was  developed  within  the  FAA  in  expanding  the  requirements  of  the  alerting 
system  to  monitor  flight  status  and  facilitate  crew  responses  to  abnormal  and 
emergency  situations.  A  contract  modification  was  made  to  add  a  fourth  phase 
to  review  accident  histories  and  the  cockpit  environment  to  determine  concept 
feasibility  of  a  Flight  Status  Monitor  (FSM).  Table  1.1-2  lists  the  major 
activities  conducted  under  the  Aircraft  Alerting  Systems  Standardization  Study. 

Phase  IV  study  results  supported  the  feasibility  of  expanding  the  functions  of 
the  alerting  system  to  perform  as  a  flight  status  monitor.  The  alerting 
function  of  the  FSM  is  identical  to  that  described  in  the  previous  studies  and 
that  is  to  alert  the  crew  to  all  non-normal  situations  for  both  flight 
operations  as  well  as  aircraft  system  operations.  However,  the  functional 
requirements  for  the  FSM  were  developed  on  the  assumption  that,  by  providing 
guidance  and  feedback  information,  crew  performance  could  be  improved. 
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Phase  IV  resulted  in  the  identification  of  the  component  functions  that  can  be 
used  to  expand  an  alerting  system  into  a  flight  status  monitor.  Specifically, 
the  following  additional  capabilities  are  necessary  for  an  alerting  system  to 
function  as  an  FSM: 

Expanded  Sensing  -  To  provide  additional  sources  of  status  data  (e.g.,  low  ac¬ 
celeration,  wind  shear,  tire/wheel  failure,  navigation). 


More  Complex  Information  Processing  -  To  provide  additional  computational  and 
data  handling  capabilities  and  to  consider  such  features  as  flight  phase  adapt¬ 
ation,  predictive  and  multiple  alerts,  alert  prioritization,  alert  inhibition, 
and  integrated  checklists. 

System  Intei-facing  -  To  carry  out  data  exchange  between  the  FSM  and  other  data 
handling  systems  such  as  flight  management,  performance  management,  flight  con¬ 
trol,  sensor  subsystems,  navigation,  communications  and  maintenance  data 
recordings. 


Displaying  -  To  provide  the  crew  with  detailed  guidance  information  to  facili¬ 
tate  their  response  to  alerts  and  provide  feedback  during  and  after  the  res¬ 
ponse  has  taken  place. 

Controlling  -  To  provide  the  capability  for  the  crew  to  interact  with  the  FSM. 


1.2  Present  Study 


The  objectives  of  the  present  study  were  to  develop  and  evaluate  alternate  FSM 
concepts  for  providing  guidance  and  feedback  data  to  facilitate  crew  and  sys¬ 
tem  effectiveness.  Table  1.1-3  summarizes  the  major  activities  that  were 
accomplished  in  the  present  two-phased  contract. 


The  Phase  I  effort  resulted  in  the  refinement  of  the  FSM  concept  and  the  de¬ 
velopment  of  several  aircraft  system  display  and  control  concepts  to  interact 
with  the  FSM.  Phase  I  also  identified  several  design  and  implementation 
issues  (e.g.,  display  formatting,  coding  schemes,  control  procedures).  During 
Phase  II,  experienced  transport  pilots  flew  simulated  scenarios  during  which 
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they  operated  the  aircraft  system  control  concepts  in  response  to  alerting 
situations.  A  combination  of  objective  (e.g.,  time,  errors,  sequence  of 
actions,  etc.)  and  subjective  measures  (rating  scales,  debriefing  question¬ 
naires  and  pilot  interviews)  were  obtained.  These  data  provided  information 
for  evaluating  the  flight  status  monitor  and  for  deriving  answers  to  the  imple¬ 
mentation  issues. 

1.3  Report  Organization 

Section  2  of  this  report  provides  an  executive  summary  for  this  contract.  Sec¬ 
tion  3  provides  detailed  descriptions  of  the  Phase  II  activities.  In  Section 
4  the  results  of  the  Phase  IT  evaluations  are  described.  Sections  5  contains 
discussions  of  the  Phase  II  test  results  and  provides  conclusions.  Section  6 
contains  recommendations  for  future  activities.  Appendix  A  provides  a  detail¬ 
ed  description  of  the  test  facility.  Appendix  B  contains  the  training  manual 
that  was  used  to  prepare  the  test  subjects  for  the  Phase  II  evaluation. 
Appendices  C  and  0  contain  the  concept-evaluation  and  debrief  questionnaires. 


2.0  FSM  EXECUTIVE  SUMMARY 


This  section  summarizes  the  major  activities  that  were  accomplished  during 
Phases  I  and  II  of  the  present  contract. 

2.1  Phase  I  Summary 

The  objectives  of  Phase  I  were  to:  develop  preliminary  FSM  concepts,  identify 
design  issues  that  impact  their  implementation  and  develop  demonstration  scen¬ 
arios  to  refine  the  preliminary  concepts. 

2.1.1  FSM  Functional  Requirements 

To  identify  the  functional  requirements  for  an  FSM  the  following  tasks  were 
performed: 

1.  Reviewed  and  refined  the  results  of  Phase  IV  of  the  Aircraft  Alerting  Sys¬ 
tems  Standardization  Study. 

2.  Reviewed  current  commercial  transport  aircraft  procedural  manuals  (e.g., 

TWA  767,  Eastern  L-1011  and  Air  Alaska  MD-80  Flight  Handbooks). 

3.  Performed  a  literature  review. 

Based  on  the  results  of  these  activities,  the  following  was  determined  to 
be  needed  to  satisfy  the  FSM  information  requirements: 

0  Procedures  -  Step-by-step  list  of  actions  required  to  resolve  the  alert¬ 
ing  situation.  These  are  currently  provided  by  a  combination  of  crew 

memory  items  and  procedures  contained  on  checklist  cards  and  amplified  in 

flight  manuals. 

0  System  Configuration  -  Representations  of  the  operation  and  function  of 
aircraft  subsystems  (e.g.,  hydraulic,  electric).  This  information  is 
currently  either  remembered  by  the  pilot  or  described  in  flight  manuals. 
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0  Fai led- System  Status  -  Representations  of  the  faulted  subsystems  with  in¬ 

dications  of  the  failed  components.  This  information  is  presently  con¬ 
tained  on  systems  panels. 

0  Aircraft  Status  -  Representations  of  the  impact  of  faulted  systems  on  the 
operational  limits  and  aircraft  flying  qualities.  This  information  is 
either  described  in  flight  manuals  or  remembered  by  the  crew. 

0  Other  Rel event  Information  -  Information  pertaining  to  the  alerting  situa¬ 
tion  which  is  relevant  to  the  remainder  of  the  flight  (e.g.,  plan  for  a 
20°  flap  landing).  This  information  is  currently  contained  in  checklist 
cards  and  flight  manuals. 

2.1.2  FSM  and  Aircraft  System  Displ ay /Control  Concepts 

After  identifying  these  information  requirements  the  study  team  identified 
the  FSM  components  and  alternative  system  control  concepts.  The  study  team 
proposed  that  the  above  information  could  effectively  be  presented  on  two  mul¬ 
tifunction  color  displays: 

1.  Procedures  Display  -  To  provide  step-by-step  procedural  action  items  to 
guide  the  crew  in  responding  to  abnormal  and  emergency  conditions. 

2.  Status  Display  -  To  provide  aircraft  status  (including  the  impact  of 
faults  on  aircraft  operating  conditions,  limits  and  flyinj  qualities), 
system  status,  and  other  pertinent  information. 

Table  2. 1.2-1  presents  a  summary  of  the  candidate  aircraft  system  control  con¬ 
cepts.  Manual,  system  aided  and  automated  concepts  were  developed.  For  each 
concept  the  pilot  acquires  step-by-step  information  for  resolving  the  alerting 
situation  from  a  procedural  checklist.  For  the  basic,  touch  panel,  and  voice 
interactive  concepts,  this  information  is  provided  on  a  multifunction  CRT. 
For  the  Multifunction  Keyboard  (MFK)  and  automated  response  concepts  the  pro¬ 
cedural  information  is  presented  on  the  MFK  scratch  pad.  Figure  2. 1.2-1  shows 
the  locations  for  the  procedures  and  status  displays  and  the  MFK. 


CONTROL  AND  DISPLAY  SUMMARY 


LEVEL  OF 
AUTOMATION 


CANDIDATE  CONCEPTS 


MANUAL 

Basic 

B 

B 

B 

1 

B 

B 

B 

B 

Basic  (with  auto  display  callup) 

B 

B 

B 

B 

B 

B 

B 

B 

SYSTEM 

AIDED 

Touch  panel  interactive  display 

B 

B 

B 

B 

B 

B 

B 

B 

Voice  interactive  display 

B 

B 

B 

B 

B 

B 

B 

B 

Multifunction  keyboard 

B 

B 

B 

B 

B 

B 

B 

B 

AUTOMATIC 

Automated  response 

B 

B 

B 

B 

X 

B 

B 

B 

B 

Table  2. 1.2-1.  Candidate  Aircraft  System  Control  Concepts 


The  major  differences  between  the  concepts,  therefore,  were  in  the  mechanisms 
provided  to  enable  the  crew  to  perform  the  procedural  action  items  and  the  man¬ 
ner  in  which  information  was  presented  to  the  crew. 

Basic  -  In  this  concept  the  pilot  used  current  technology  system  panels,  lo¬ 
cated  on  the  center  pedestal  or  in  the  overhead  to  accomplish  the  checklist 
items. 

Touch  Panel  -  Here  the  pilot  accomplished  the  checklist  by  depressing  the 
appropriate  switch,  valve,  etc.,  that  was  represented  schematically  on  the  sta¬ 
tus  display.  Distinct  schematic  diagrams  were  presented  for  each  checklist 
item. 

Voice  Interactive  -  In  this  concept  the  pilot  depressed  the  voice  switch  on 
the  center  stick  to  activate  the  voice  system,  and  then  used  voice  commands  to 
call  up  various  checklists,  status  displays  and  to  perform  checklist  items  dis¬ 
played  on  the  procedural  display. 

Multifunction  Keyboard  -  Checklist  items  presented  on  the  MFK  scratchpad  were 
accomplished  by  depressing  a  switch  on  the  MFK.  A  single  switch,  labeled 
"GO",  was  used  to  execute  each  checklist  item. 

Automatic  Reconfiguration  -  Implementation  of  this  concept  was  similar  to  the 
MFK  concept,  except  a  single  switch,  labelled  "EXEC"  was  used  to  initiate  the 
automatic,  serial  accomplishment  of  all  applicable  checklist  items.  Switches 
were  also  provided  to  stop  and  restart  automatic  reconfiguration. 

2.1.3  Implementation  Issues 

During  concept  development,  numerous  design  issues  were  identified  which  re¬ 
quired  research  and  evaluation.  These  issues  related  to  the  display  content, 
methods  of  information  coding,  and  symbology  design  for  the  procedures  and 
status  displays.  Other  issues  involved  mechanisms  for  crew  interaction  with 
the  displays,  for  accomplishing  checklist  items,  and  for  accomplishing  alert 
prioritization,  inhibition  and  flight  phase  adaptation. 


To  provide  answers  to  these  design  issues  a  literature  review  was  performed,  a 
questionnaire  was  developed,  and  a  Phase  II  preliminary  evaluation  of  alterna¬ 
tive  concepts  were  performed.  The  results  of  these  activities  were  used  to 
refine  the  concepts  for  the  Phase  II  evaluation. 

2.1.4  Demonstration  Scenarios 

The  criteria  used  to  develop  the  scenarios  included: 

0  The  scenarios  were  designed  to  represent  real-world  situations  which  were 
developed  from  earlier  accident  surveys. 

0  The  scenarios  were  developed  to  impose  realistic  pilot  task  loadings  to 
facilitate  the  collection  of  meaningful  data. 

0  The  scenarios  had  to  exercise  all  of  the  features  of  the  FSM  and  provide 
a  basis  for  evaluating  their  effectiveness. 

Three  simulated  flight  scenarios  were  developed: 

1.  Differential  Lift  -  An  approach  in  bad  weather  with  a  sequence  of  events 
which  lead  up  to  differential  lift  and  stall  situations. 

2.  Take-off  Abort  -  A  scenario  in  which  aircraft  and  environmental  condi¬ 
tions  prevent  the  aircraft  from  achieving  sufficient  acceleration  for  a 
safe  take-off. 

3.  Navigation  Error  -  Scenario  in  which  navigation  errors  and  multiple 
system  failures  occur.  If  the  pilot  does  not  respond  appropriately  to 
lower  level  alerts  (cautions,  warnings)  the  situation  will  degrade  and 
trigger  a  time-critical  warning  (ground  proximity). 

2.1.5  Concept  Implementation 

The  hardware  and  software  required  to  implement  the  FSM  concepts  and  demon¬ 
stration  scenarios  were  incorporated  into  Boeing's  Commercial  Airplane  Company 
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mock-up  and  integration  laboratory.  The  center  of  the  facility  is  a  generic 
widebody  flight  station  cab.  The  lab,  shown  in  Figure  1.5-1  is  equipped 
with  state-of-the-art  color  displays  that  are  used  to  present  flight  (HSI, 
VSI,  altitude  airspeed,  etc.),  system  status  (hydraulic,  engine,  electrical, 
etc.)  and  FSM  (alert,  procedural  and  status)  information.  In  addition,  opera¬ 
tional  flight  control  systems  (center  stick,  throttles,  flaps,  speed  brakes, 
etc.)  were  provided  to  simulate  a  two-engine  commercial  jet  transport  and  add 
realism  to  the  evaluation  environment.  A  complete  description  of  the  test 
facility  can  be  found  in  Appendix  A. 

2.1.6  Phase  I  Concept  Evaluations 

Two  demonstrations  were  conducted  to  evaluate  and  refine  the  Phase  I  FSM  con¬ 
cepts.  The  study  team  members  and  the  FAA  contract  monitor  participated  in 
the  first  demonstration,  and  six  Boeing  pilots  served  as  the  test  subjects  for 
the  second  demonstration.  The  demonstrations  consisted  of  a  test  conductor 
going  through  the  simulated  differential  lift  scenario  using  the  FSM  Basic  con¬ 
cept.  Even  though  only  the  Basic  concept  was  implemented,  all  other  control 
concepts  were  reviewed.  During  the  demonstrations,  participant  comments  and 
opinions  were  solicited  to  obtain  data  for  refining  the  candidate  concepts. 

2.1.7  Refine  Candate  Concepts 

The  results  of  all  of  the  activities  summarized  above  were  used  to  provide 
answers  to  some  of  the  FSM  implementation  issues  and  to  refine  the  concepts 
for  the  more  detailed  Phase  II  evaluation. 

Detailed  descriptions  of  Phase  I  activities  and  results  are  provided  in 
Summers,  Berson,  Hanson  and  Rossi,  1RR4  (Ref.  5). 

2.2  Phase  II  Summary 

The  objectives  of  Phase  II  were  to  implement  the  FSM  and  aircraft  system  con¬ 
trol  concepts  in  a  simulator  and  to  evaluate  their  relative  effectiveness  in 
facilitating  a  pilot's  response  to  abnormal  and  emergency  aircraft  situations. 
The  major  activities  accomplished  during  this  phase  are  summarized  below: 
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2.2.1  Develop  Phase  II  Test  Plan 

A  detailed  test  plan  was  developed  to  describe  Phase  II  test  objectives  and 
the  facilities,  test  subject  characteristics,  and  procedures  required  to  evalu¬ 
ate  the  preliminary  FSM  concepts.  Two  types  of  evaluation  techniques  were 
used  for  concept  evaluation:  (1)  pilot  activity,  recorded  in  real-time  and 
(2)  post  flight  and  program  debriefings. 

The  test  was  designed  to  provide  data  for  evaluating:  FSM  implementation  and 
design  characteristics;  the  effect  of  aircraft  system  control  type  on  the  FSM 
design;  the  relative  perceived  effectiveness  and  pilot  workload  associated 
with  the  system  controls;  and  the  problems  and  research  issues  remaining  that 
need  to  be  addressed  before  developing  FSM  design  guidelines. 

2.2.2  Develop  FSM  Simulation  Specifications 

The  objective  of  this  task  was  to  incorporate  the  changes  in  FSM  functional 
concepts.  First  the  system  specification  was  modified  to  incorporate  the 
functional  changes  derived  from  the  Phase  I  demonstrations.  Appropriate 
changes  recommended  by  the  observers  of  the  concept  demonstration  were 
implemented. 

Secondly,  and  more  significantly,  the  concept  system  to  be  exercised  and  eval¬ 
uated  in  Phase  II  was  a  more  complete  system  than  in  the  Phase  I  demonstra¬ 
tion.  More  alerts  for  a  broader  range  of  alerting  functions  were  implemented. 
Many  functions  previously  handled  by  the  host  computer  for  the  Phase  I  demon¬ 
stration  were  designed  into  the  FSM  real-time  test  configuration. 

In  addition,  the  test  plans  and  the  simulation  scenarios  were  altered  to  meet 
the  requirements  of  the  Phase  II  evaluation.  Scenarios  and  equipment  were 
changed  as  necessary  to  permit  accumulation  of  pilot  performance  and  prefer¬ 
ence  data. 


2.2.3  Develop  Simulator  Demonstration  Systems 


Suitable  hardware/software  was  assembled  for  the  Phase  II  evaluation  in  an 
operational  simulator.  Hardware  subsystems  were  configured  and  reprogrammed 
to  perform  functions  which  were  not  demonstrated  in  Phase  I  or  were  accomplish¬ 
ed  by  the  host  computer.  Necessary  interfaces  were  modified  to  link  the  sys¬ 
tem  to  the  flight  simulator. 

Prior  to  installation  in  the  simulator,  the  system  components  were  bench  test¬ 
ed  to  insure  proper  operation.  This  task  included  testing  of  subcomponents  of 
the  special  test  equipment  as  they  were  reconfigured.  Additionally,  as  more 
subassemblies  and  capabilities  were  added  to  the  test  system,  operational 
tests  were  performed  to  ensure  operability  and  compatibility.  The  complete 
test  assembly  was  bench  tested  before  installation  in  the  simulator. 

The  test  equipment  was  installed  and  its  operation  in  the  flight  simulator  was 
verified  including  subassembly  testing,  such  as  the  aural  signal  generator, 
the  displays,  and  the  data  collection/input  devices. 

t 

I  Finally,  the  entire  system  was  pre-tested  using  the  test  scenarios,  the  FSM, 

and  the  system  control  concepts.  Prior  to  conducting  the  actual  test  and 
evaluation,  a  limited  number  of  sample  tests  were  conducted  to  assess  the  re¬ 
liability  of  the  system  and  to  solidify  test  procedures  and  the  test  schedule. 

2.2.4  Phase  II  Evaluation 

Eighteen  experienced  transport  pilots,  divided  into  ID  two-man  crews  (two 
pilots  flew  with  an  observer  pilot  as  the  first  officer  due  to  the  lack  of 
availability  of  a  second  crew  member  during  their  test  period),  served  as  the 
test  subjects  for  this  study.  Each  crew  flew  four  training  scenarios,  four 
test  scenarios,  and  observed  another  scenario.  In  these  nine  flight  segments 
each  crew  member  either  got  hands-on  experience  or  observed  the  execution  of 
the  scenarios  using  each  FSM  concept. 


Prior  to  testing,  the  crews  were  briefed  thoroughly  and  received  hands-on 
experience  on  the  operational  characteristics  of  the  simulator,  on  FSM 
features  and  on  associated  fest  requirements.  At  the  completion  of  each  test 


run  the  crews  were  required  to  complete  a  concept  evaluation  questionnaire 
(see  Appendix  C).  At  the  end  of  the  testing  each  pilot  filled  out  the  FSM 
program  debriefing  questionnaire,  contained  in  Appendix  D,  and  informal 
interviews  were  conducted  to  solicit  additional  pilot  comments. 

2.2.5  Phase  II  Results 

The  results  section  is  partitioned  into  two  major  sections,  one  addressing  the 
FSM  components  and  one  the  aircraft  system  display  and  control  concepts.  The 
results  are  summarized  below  and  described  completely  in  Section  4.0. 

2.2.5. 1  Flight  Status  Monitor  Components 

Three  FSM  display  components  were  evaluated,  the  alert  display,  the  procedures 
display  and  the  status  display.  Pilots  also  made  recommendations  concerning 
the  design  and  implementation  of  the  FSM  system. 

Alert  Display 

0  Display  was  well  received  and  considered  a  necessary  part  of  FSM 
0  Use  was  consistent  with  previous  research 

0  Was  used  to  identify  the  non-normal  condition  and  its  urgency 

0  Controls  associated  with  the  display  created  some  confusion  as  test¬ 

ed  and  need  to  be  revised 

Procedures  Display 


0  The  procedures  display  was  considered  an  essential  element  of  the  FSM 

0  Use  of  procedures  display  was  considered  much  superior  to  the  Quick 

Reference  Handbook 

Both  normal  and  non-normal  procedures  should  he  displayed 
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0  Checklist  should  be  displayed  automatically  for  both  warnings  and 
cautions 

0  Checklists  for  new  alerts  should  be  integrated  with  existing  check¬ 
list 

0  Checklist  items  should  be  prioritized 

0  The  display  should  present  checklist  items  and  flight  critical  infor¬ 
mation 

0  Full  checklist  should  be  available  to  the  crew  even  if  it  requires  a 
multiple  page  presentation 

0  Feedback  indicating  completed  items  was  considered  essential 

0  Color  coding  was  the  preferred  method  of  providing  coded  information 

0  Unnecessary  action  items  should  be  eliminated 
Status  Display 

0  The  status  display  was  considered  an  essential  element  of  the  FSM 

0  Information  desired  includes  aircraft  status,  failed  system  status 

and  handbook  information 

0  Aircraft  status  page  should  include  information  about  the  opera¬ 

tional  status  of  the  gear,  brakes,  steering,  tires,  engines  and 
flight  control  surfaces 
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Aircraft  status  page  should  also  include  operational  limitations  and 
restrictions  that  have  been  imposed 
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0  Failed  system  page  should  present  schematics  and  written  text  per¬ 
taining  to  the  system  that  has  failed 

0  The  failed  system  page  should  have  the  capability  of  displaying 

information  at  different  levels  of  detail  according  to  crew  needs 

0  The  checklist  status  page  caused  the  most  concern  and  its  informa¬ 
tion  was  not  used  consistently 

0  The  checklist  status  page  was  not  considered  a  desired  part  of  the 
FSM 

Desired  Changes 

0  Reduce  the  number  of  button  pushes  required  to  operate  the  system 

0  Improve  the  schematics  of  the  status  display  to  make  them  more 

easily  understood 

0  Present  both  warning  and  caution  checklists  automatically 

0  Provide  dedicated  switches  for  each  status  page 
2. 2. 5. 2  Aircraft  System  Control 

The  methods  used  to  control  the  aircraft  and  the  types  of  information  avail¬ 
able  for  display  by  those  systems  have  a  significant  impact  on  FSM  archu 
ture.  Therefore,  evaluation  data  was  generated  by  providing  the  pilots  with 
experience  using  the  FSM  with  different  control  types.  This  data  not  only  pro¬ 
vides  an  indication  of  FSM  operation,  but  also  furnishes  an  insight  into  the 
type  of  system  controls  that  could  be  used  in  designing  the  system.  Measures 
of  perceived  workload  and  response  time  were  also  gathered  for  each  of  the  con¬ 
trol  types. 
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Conventional  System  Control 

0  Rated  as  the  most  desirable  control  type  because  of  pilots' 
familiarity 

0  Ratings  were  consistent  across  all  evaluation  criteria 

0  The  checklist  status  page  was  not  used  with  this  type  of  control 

0  The  checklist  status  page  was  considered  a  distraction 

Touch  Control 

0  Requires  the  checklist  status  page  to  operate 

0  If  the  checklist  status  page  is  required,  then  it  should  activate 
automatical ly 

0  Area  to  be  touched  should  be  highlighted 

0  All  switching  should  be  done  on  the  same  touch  area  if  possible 

0  Dedicated  system  control  panels  would  be  required  even  though  the 

majority  of  switching  is  done  on  the  touch  panel 

0  Effectiveness  of  touch  panels  was  questioned  under  vibration  con¬ 

dition,  e.g.  turbulance 

Voice  Control 

0  The  scope  of  the  test  and  the  available  training  time  did  not  permit 
an  accurate  assessment  of  voice  control 


0 


Pilots  were  frustrated  by  recognition  inconsistency 


0  The  voice  control  used  did  not  seem  appropriate  for  simple  switching 
functions,  which  could  be  as  easily  accomplished  manually 

Multifunction  Keyboard  Control 

0  It  is  necessary  to  decide  which  items  are  controlled  from  the  key¬ 
board  and  which  require  system  controls  and  to  make  the  distinction 
clear  to  the  crew 

0  Monochromatic  displays  make  it  difficult  to  distinguish  between 

completed  and  uncompleted  items  and  to  find  the  current  action  item 

0  Much  more  positive  coding  is  required  for  a  monochromatic  display 
Automatic  Reconfiguration 

0  This  control  concept  rated  the  highest  on  most  of  the  evaluation 

criteria 


0  As  with  any  automatic  system,  it  must  have  a  low  probability  of 
failure  before  it  is  generally  accepted 

0  Functions  that  are  controlled  by  the  automatic  system  must  be  dis¬ 
tinguished  from  pilot  functions 

0  Features  considered  essential  to  the  automatic  system  include: 

Selection  of  automatic  should  be  a  crew  option 
Systems  should  have  the  capability  of  stopping  the  automatic 
sequence 

System  should  stop  before  critical  items 
Automatic  sequence  should  stop  when  a  new  alert  appears 
Information  should  be  presented  which  reflect  any  recon¬ 
figuration 


The  pilots  were  asked  to  compare  the  workload  imposed  hy  using  the  system  con¬ 
trol  concepts  that  they  flew  (the  automatic  concept  was  only  demonstrated)  and 
the  FSM  as  compared  to  their  present  system.  The  interpretation  of  these  re¬ 
sults  must  be  made  realizing  that  the  operational  procedure  of  requiring  the 
flying  pilot  to  perform  the  action  items  imposes  a  higher  workload  than  normal 
flight  operations.  This  difference  withstanding,  the  airline  pilots  consis¬ 
tently  rated  all  the  control  concepts  as  easier  than  their  present  operation, 
while  certification  pilots'  average  rating  of  the  workload  was  the  same  or 
more  difficult  than  current  operation.  All  the  pilots  felt  that  the  display 
of  checklists  significantly  decreased  their  workload.  Color  coding  the  action 
items  decreased  the  time  required  to  identify  the  information  they  wanted  and 
the  mental  effort  required  to  keep  track  of  the  whole  response  process.  Cen¬ 
tralization  of  the  information  reduced  overall  scanning  and  permitted  the  crew 
to  quickly  identify  the  pertinent  information. 

The  time  taken  to  complete  the  checklist  items  was  used  as  a  measure  of  the 
effectiveness  of  the  FSM/system  control  system.  An  analytic  number  was  gen¬ 
erated  for  the  automatic  reconfiguration  concept  using  2.5  seconds  for  system 
actions  (the  average  time  required  for  this  type  of  action  and  to  display  the 
reconfiguration  information)  and  ID  seconds  for  pilot  response  items  (an 
average  time  from  the  test  data  for  pilot  "check"  items).  Comparing  this 
figure  with  the  test  data  the  automatic  system  performed  significantly  faster 
than  any  of  the  manual  or  semi-automatic  systems,  as  was  expected.  For  normal 
procedures  the  type  of  system  control  (not  considering  automatic)  did  not  seem 
to  have  an  effect  on  response  times.  However,  for  non-normal  situations  the 
amount  of  automation  and  the  urgency  of  the  alert  determined  the  time  taken  to 
respond.  This  indicates  that  where  time  becomes  a  factor,  the  crews  take  ad¬ 
vantage  of  features  which  reduce  the  time  to  respond. 

2.2.6  Discussion  and  Conclusions 

The  ability  of  the  flight  status  monitor  to  provide  guidance  and  feedback 
along  with  the  alerting  functions  offers  a  potential  of  improving  aircraft 
safety  by  enhancing  the  effectiveness  of  the  flight  crews  in  both  normal  and 
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non-normal  situations.  It  achieves  this  potential  by  reducing  the  probability 
of  error,  the  time  to  respond  and  the  perceived  workload  while  making  more  of 
the  crew's  channel  capacity  available  for  flying  the  aircraft. 

Because  of  its  central  location  and  coding  of  information  the  alert  display 
was  seen  as  facilitating  the  pilot  response  to  alerts.  The  aircraft  alerting 
system  guidelines  established  in  previous  work  should  be  used  in  designing 
this  display.  The  controls  associated  with  the  alerting  components  include:  a 
method  of  storing  nonwarning  alerts;  a  means  of  recalling  stored  alerts;  a 
method  of  paging  through  the  display;  and  the  capability  of  selecting  a 
specific  alert (s)  in  order  to  perform  some  system  actions. 
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The  guidance  component  is  provided  by  the  procedures  display,  which  was  pre¬ 
ferred  over  the  quick  reference  handbook  as  a  means  of  providing  checklists. 
It  was  identified  as  a  necessary  component  of  the  FSM  because  it  not  only  pre¬ 
sented  the  appropriate  action  steps,  but  also  kept  track  of  what  had  been  per¬ 
formed.  The  results  indicate  that  the  pilots  wanted  to  use  the  checklist  to 
plan  their  course  of  action  and  to  know  which  actions  had  already  been  accom¬ 
plished.  In  order  to  effectively  take  advantage  of  the  guidance  component  the 
FSM  should  have  the  capability  to  formulate,  integrate  and  modify  checklists 
according  to  the  situation.  Checklists  should  be  limited  only  to  the  actions 
that  are  required.  Unnecessary  actions  should  be  eliminated.  Contingency 
statements  ("IF")  that  depend  on  system  data  should  be  eliminated.  For  multi¬ 
ple  checklist  situations,  the  system  should  be  able  to  integrate  and  priori¬ 
tize  the  action  items  to  facilitate  the  response.  Again,  the  guidance  display 
should  follow  the  alerting  system  guidelines.  The  controls  associated  with 
this  component  should  provide  the  capability  to:  select  checklists  not  only 
for  current  problems  and  for  normal  procedures  associated  with  the  current 
flight  phase,  but  also  for  any  other  normal  or  non-normal  procedure  that  they 
wish  to  review;  page  the  checklist  forward  and  backward;  select  a  different 
sequence  of  action  based  on  situational  knowledge;  and  signal  the  completion 
of  a  pilot  action. 
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The  major  feedback  component  of  the  FSM  system  is  the  status  display.  Three 
pages  of  information  should  be  used  to  providp  this  fpprihark:  the  overall  air¬ 
craft  status  page;  the  failed  system  status  page;  and  the  supplemental  infor- 
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mation  page.  The  requirement  for  providing  information  about  the  action  items 
in  the  checklists  is  dependent  on  the  type  of  aircraft  system  control  being 
used.  If  the  controls  require  an  interaction  with  the  status  display,  e.g., 
touch  panel,  then  a  checklist  status  page  is  needed.  Pilots  felt  that  the  air¬ 
craft  status  page  should  be  presented  automatically  when  a  non-normal  situa¬ 
tion  requires  immediate  attention  or  action.  It  should  also  be  available  at 
all  times  for  manual  activation  and  be  continuously  updated.  Both  alphanu¬ 
meric  and  graphic  techniques  should  be  used  to  integrate  the  appropriate  in¬ 
formation.  The  failed  system  status  page  presents  information  concerning  the 
failure  and  its  effect  on  associated  systems  and  should  have  the  capability  of 
presenting  more  detailed  information  on  request.  Graphic  and  alphanumeric 
presentation  techniques  should  be  used  for  this  page  also.  The  information 
page  of  the  status  display  provides  the  crew  with  supplemental  information 
from  the  flight  manual  about  non-normal  situations.  As  the  feedback  component 
of  the  FSM  the  status  display  should  have  characteristics  which  are  in  accor¬ 
dance  with  the  guidelines  previously  documented. 

Control  functions  associated  with  the  status  display  should  provide  the  capa¬ 
bility  to;  activate  the  status  display;  select  the  particular  status  page  that 
is  required;  page  through  the  sub-pages;  and  select  greater  detail  on  the 
failed  system  status  page. 

During  this  study  the  FSM  was  tested  with  five  different  concepts  for  con¬ 
trolling  the  aircraft  systems.  This  combination  demonstrated  that  the  design 
of  the  FSM  is  affected  by  the  system  control  concept  being  employed.  Because 
system  control  is  aircraft-design  specific,  the  FSM  must  be  designed  to  ac¬ 
commodate  a  wide  range  of  design  concepts.  Furthermore,  the  advanced  techno¬ 
logies  used  to  operate  the  aircraft  systems  are  amenable  for  FSM  system  con¬ 
trol  . 

2.3  Recommendations  for  Future  Activity 

Two  areas  of  activity  are  addressed,  the  FSM/pilot  interface  and  the  FSM/air- 
craft  interface.  The  Phase  I  and  Phase  II  efforts  have  identified  a  number  of 
issues  concerning  the  FSM/pilot  Interface,  which  require  resolution  before  any 
meaningful  guideline  can  be  written.  One  objective  of  any  future  program 
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should  be  the  resolution  of  these  issues  in  an  integrated  testing  program  and 
the  use  of  the  resulting  data  to  update  and  refine  the  FSM.  The  updated  FSM 
should  then  be  installed  in  a  full  mission  simulator  so  that  it  can  be  valida¬ 
ted  against  conventional  alerting  methods  for  all  levels  of  alerting  activity. 

Concerning  the  FSM/aircraft  interface,  in  order  for  the  FSM  to  be  effective  it 
must  be  able  to  gather  and  process  large  amounts  of  information  about  the 
aircraft.  Traditional  computing  techniques  requiring  well  structured  problems 
with  complete  data  bases  and  a  single  correct  solution  may  not  be  applicable 
to  the  FSM  processing.  Artificial  intelligence  on  the  other  hand  is  a  tech¬ 
nique  which  can  operate  with  ill  structured  problems  which  require  a  search 
for  a  solution  and  can  use  incomplete  information  to  arrive  at  a  probabilistic 
answer.  The  most  applicable  subfield  of  artificial  intelligence  to  the  FSM 
problem  would  be  the  knowledge  based  expert  system.  Some  of  the  issues  which 
need  investigation  to  apply  this  type  of  computing  technique  and  interface  the 
FSM  with  the  aircraft  include: 

1)  Definition  of  the  scope  of  the  knowledge  base 

2)  Establishment  of  an  expert  pool  for  building  the  data  base  and 
develop  a  scheme  to  integrate  data  from  a  number  of  experts  and  pro¬ 
vide  a  single  meaningful  answer 

3)  Identification  of  the  set  of  alerts 

4)  Investigation  of  operational  and  design  considerations  with  respect 
to  their  impact  on  system  sensors  and  potential  FSM  operation 

5)  Definition  of  prioritization  and  inhibition  schemes  for  both  alerts 
and  checklists  and  identification  of  an  implementation  plan 

6)  Determination  of  the  impact  of  arriving  at  probabilistic  answers  on 
the  definition  of  system  reliability 

7)  Development  of  a  plan  and  criteria  for  the  test  and  certification  of 
expert  systems 
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3.0  PHASE  II  TECHNICAL  APPROACH 


As  a  result  of  Phase  I,  it  became  evident  that  limitations  in  the  existing 
data  base  precluded  answering  all  FSM  design  and  implementation  questions. 
Phase  II  of  the  study  added  to  the  data  base  by  evaluating  the  candidate  con¬ 
cepts  in  a  simulated  cockpit  environment.  The  FSM  was  evaluated  by  having  ex¬ 
perienced  jet  transport  pilots  fly  scenarios  with  the  FSM  and  different  system 
control  concepts  and  respond  to  a  sequence  of  alerts.  A  combination  of  objec¬ 
tive  and  subjective  performance  measures  were  used  to  evaluate  the  FSM  and  the 
alternative  display  and  control  concepts.  The  existing  data  base  was  expanded 
and  remaining  limitations  were  identified. 

3.1  Objectives 

The  overall  objective  of  Phase  II  was  to  evaluate  the  design,  implementation, 
and  the  perceived  effectiveness  of  the  FSM  and  candidate  aircraft  system  con¬ 
trol  concepts. 

The  specific  objectives  were: 

1)  To  determine  if  the  FSM  concept  increases  the  pilot  awareness  of  the 
operational  status  of  thp  aircraft. 

?-)  To  determine  what  information  the  pilot  uses  when  responding  to  non¬ 
normal  situations  and  to  determine  if  there  are  any  specific  informa¬ 
tion-gathering  patterns  associated  with  the  different  display  and 
control  concepts. 

3)  To  evaluate  the  capability  of  each  candidate  concept  to  operate  in  a 
fixed-based  simulated  flight  deck  environment. 

4)  To  determine  the  perceived  workload  required  to  operate  the  FSM  con¬ 
cepts  and  the  effect  of  system  control  on  that  perception. 

5)  To  determine  what  changes  are  recommended  by  the  user  community  for 
FSM  design  and  implementation. 
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EXPERIENCE  SPECIFIC  AIRCRAFT  EXPERIENCE  (NUMBER  OF  PILOTS) 

itatistic  cri-i..  w 

Flight-  Years 

htwrs  flying  Regency*  707  727  737  747  757^67  DC-9  DC-10  DC-8 

Mean  8420  27.2  A  4  13  5 


3.2  Subject  Pilots 

Eighteen  experienced  jet  transport  pilots  participated  in  the  Phase  II  simula¬ 
tor  tests.  In  order  to  get  an  input  based  on  a  wide  range  of  experience, 
pilots  were  selected  from  three  areas  of  the  flying  community:  line  opera¬ 
tions;  certification;  and  manufacturing.  Six  line  pilots  representing  Alaska, 
United,  and  Northwest  Orient  airlines,  six  FAA  certification  pilots  from  the 
Northwest  Region  four  engineering  test  and  two  training  pilots  from  Boeing 
made  up  the  sample.  As  a  group,  each  of  the  pilots  that  responded  to  the 
debriefing  questionnaire  (13  pilots  responded)  averaged  8420  flight  hours  and 
27  years  of  flight  experience.  All  of  the  pilots  were  qualified  on  more  than 
one  aircraft  and  over  half  of  them  were  qualified  on  more  than  two.  A  summary 
of  their  experience  is  presented  in  Table  3.2-1.  The  numbers  on  the  right 
hand  side  of  the  table  indicate  the  specific  experience  by  aircraft  type  and 
the  order  of  that  experience  (A  is  the  most  recent).  As  can  he  seen,  the 
sample  contains  a  wide  range  of  aircraft  experience  from  which  to  respond  to 
the  subjective  questionnaire. 

3.3  Facilities 

The  nature  of  the  test  dictated  the  use  of  a  facility  which  could  provide  a 
flight  deck  environment  and  be  flexible  enough  to  accommodate  the  flight  sta¬ 
tus  monitor  and  various  aircraft  system  display  and  control  concepts.  The 
facility  chosen  for  the  evaluation  was  the  Boeing  Aircraft  Company  Flight  Deck 
Research  Laboratory.  This  facility  was  designed  to  provide  a  generic  cockpit 
environment  for  the  test  and  evaluation  of  new  control  and  display  techno¬ 
logies.  The  basic  functions  for  which  the  facility  was  designed  are  to  eval¬ 
uate  crew  information  requirements,  the  display  technologies  for  providing 
this  information  and  the  control  technologies  for  crew  interaction. 

A  second  purpose  of  the  facility  is  to  evaluate  the  integration  of  new  tech¬ 
nology  into  the  flight  deck.  It  accomplishes  this  purpose  through  the  use  of 
modular  design  which  provides  the  flexibility  to  permit  the  easy  introduction 
of  new  hardware  and  the  ability  to  change  the  flight  deck  system  configura¬ 
tion.  System  software  is  also  modularized  to  facilitate  change.  Interface 


equipment  is  flexible  allowing  for  a  wide  variety  of  engineering  development 
activities.  Figures  3.3-1  and  3.3-2  illustrate  these  facilities  and  a  more 
detailed  description  is  provided  in  Appendix  A. 


In  addition  to  the  airplane/flight  deck  simulation,  the  FSM  simulation  system 
was  implemented  to  represent  the  FSM  information  under  a  variety  of  normal  and 
non-normal  situations.  The  system  consists  of  six  basic  elements:  (a)  the 
alert  controller  which  was  the  controlling  element  for  the  alerting  lights, 
tone  and  voice;  (b)  the  scenario  controller  which  controlled  the  alert  scenar¬ 
ios;  (c)  the  FSM  logic  unit  which  provided  the  rules  for  FSM  operation;  (d) 
the  graphics  generator  which  provided  the  checklists  and  all  schematics;  (e) 
the  aircraft  system  display  and  control  components  which  provided  the  means  to 
operate  the  aircraft  systems;  and  (f)  the  communications  network  which  had  the 
ability  to  establish  two-way  communications  with  the  crew  and  to  make  both 
audio  and  video  flight  records.  A  self-contained  data  recording  system  was 
also  available  for  the  FSM  simulator. 

The  underlying  objective  in  the  development  of  the  FSM  simulation  system  was 
to  provide  a  flexible  tool  which  could  be  utilized  throughout  the  FSM  program. 

It  is  capable  of  reproducing  the  flight  deck  alerting  functions  in  a  wide  var¬ 
iety  of  normal  and  non-normal  situations  at  any  time  during  a  flight.  It  can 
provide  this  capability  for  a  wide  range  of  test  paradigms  that  may  range  from 
bench  testing  to  high  fidelity  simulation  or  possibly  flight  test.  The  modu¬ 
lar  design  of  the  system  permits  the  utilization  of  new  sensor  data  and  new 
alerts  as  they  become  available.  Because  the  scenario  controller  generates 
alert  sequences,  any  operational  problem  can  be  investigated. 

The  voice  generation  model  can  provide  an  accurate  reproduction  of  any  voice 
model  whether  it  is  commercially  available  or  experimental  in  nature.  The 
data  collection  module  is  a  floppy  disk  based  recording  and  play  back  system 
which  is  not  dependent  on  the  host  computer.  Using  the  disks  that  are  re¬ 
corded  in  real  time,  the  system  can  play  back  the  sequence  of  actions  that 
were  taken  to  resolve  any  situation.  A  full  description  of  the  FSM  simulation 
system  is  presented  in  Appendix  A. 
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and  Integration  Laboratory 


3.4  Methodology 

The  flight  status  monitor  simulation  system  was  implemented  in  the  test  cah. 
An  aircraft  model  was  installed  and  a  flight  scenario  designed.  Three  alert 
scenarios,  one  training,  one  test  and  one  demonstration,  were  developed  to 
exercise  the  system  and  the  FSM  functions.  The  pilots,  in  crews  of  two,  flew 
the  scenarios  with  four  system  control  concepts  and  observed  a  demonstration 
of  the  fifth.  The  pilot  performance  was  observed  and  recorded  during  the 
training  and  test  flights.  After  the  completion  of  each  test  flight  a  ques¬ 
tionnaire  was  administered  to  obtain  the  pilot's  opinions  on  FSM  operation 
with  the  system  control  concept  that  was  just  flown.  Through  these  question¬ 
naires  the  pilots  were  able  to  make  their  inputs  concerning  the  FSM  implemen¬ 
tation,  design  and  utilization. 

3.4.1  Evaluation  Rationale 

A  review  of  the  candidate  aircraft  system  di spl ay /control  concepts  revealed 
that  some  of  the  designs  of  their  prototype  implementation  were  more  advanced 
than  others.  It  was  decided  by  the  study  team  that  conducting  a  comparative 
evaluation  using  performance  data  would  be  unduly  affected  by  those  concepts 
whose  technological  development  was  not  as  advanced  as  the  others,  and  the  re¬ 
sulting  interaction  with  the  FSM  operation  could  mask  any  effect  of  the  infor¬ 
mation  provided  by  the  system  on  crew  performance.  It  was  therefore  concluded 
that  the  study  would  be  more  meaningful  if  the  operational  and  procedural 
aspects  of  each  concept  were  presented  to  the  pilots  and  evaluated.  This  data 
would  permit  the  investigation  of  the  operational  and  information  management 
aspects  of  concepts  as  well  as  allowing  the  pilots  to  compare  the  concepts. 
This  conclusion  did  not  compromise  the  basic  intent  to  refine  the  concept  of 
flight  status  monitoring. 

3.4.2  Concept  Implementation 

3. 4. 2.1  Flight  Status  Monitor  Components 

The  flight  status  monitor  system  consisted  of  the  alerting  components  which 
attracted  the  crew's  attention  to  the  non-normal  sit(;ation,  identifying  the 


problem  and  providing  an  indication  of  its  urgency;  the  guidance  components 
which  contained  the  information  for  the  crew  to  respond  to  the  situation;  the 
feedback  components  which  provided  the  crew  an  indication  of  the  aircraft 
status  and  indicated  what  effect  the  crew  response  was  having;  and  the  control 
components  which  permitted  crew/FSM  interaction. 

The  alerting  components  were  comprised  of  master  visual  and  aural  alerts  and 
the  alert  display.  The  master  visual  alert  was  located  on  the  glareshield  and 
the  master  aural  alert  consisted  of  a  different  sound  for  each  of  the  three 
urgency  levels.  Both  of  these  alerts  could  be  cancelled  by  depressing  the 
master  warning/caution  switch.  Simultaneously  with  the  master  alert,  an  alpha¬ 
numeric  message  appeared  on  the  alert  display.  The  alerts  were  color  coded 
and  prioritized  according  to  alert  level  and  time  of  occurrence.  In  addition, 
there  was  a  voice  display  that  occurred  automatically  for  a  time-critical 
alert  and  was  selectable  for  the  remainder  of  the  alerts  by  depressing  the 
thumb  switch  on  the  control  stick. 

The  guidance  and  feedback  components  were  provided  by  two  displays:  the  pro¬ 
cedures  display  and  the  status  display.  The  procedures  display  presented 
step-by-step  procedures  in  a  checklist  format  with  one  action  per  line.  The 
lines  were  color  coded  to  differentiate  the  completed  and  the  incompleted  pro¬ 
cedures.  The  status  display  had  four  major  pages  of  information  providing 
pictorial  and  alphanumeric  presentations  of: 

11  The  aircraft  status  showing  the  operational  limits  and  the  nonoper¬ 
ating  systems. 

2)  Simplified  schematic  diagrams  of  the  systems  involved  in  the  proce¬ 
dural  items. 

3)  A  simple  schematic  diagram  identifying  the  primary  failure. 

4)  Additional  information  affecting  aircraft  operation. 

The  FSM  is  operated  by  using  the  line  select  and  function  control  keys.  The 
line  select  keys  allow  the  selection  of  a  specific  alert.  The  keys  at 


34 


bottom  of  the  display  allow  selection  of  the  procedures  and  status  displays, 
alert  display  paging,  storage  and  recall  of  alerts  and  voice  control 
activation. 


higure  3.3-2  presents  the  FSM  layout  in  the  simulator.  The  alert  display  was 
located  on  the  lower  right  side  of  the  pilot's  panel;  the  procedures  display 
is  the  upper  left  display  in  the  center  panel;  the  status  display  is  directly 
under  the  procedures  display;  in  the  upper  left  corner  of  the  center  isle 
stand  is  the  multifunction  control-display  unit  (CDU)  which  for  one  of  the 
test  flights  was  used  to  present  a  monochromatic  version  of  the  procedures 
display. 

3. 4. 2. 2  Aircraft  System  Interaction  Concepts 

The  FSM  was  tested  using  a  number  of  different  means  of  interacting  with  the 
aircraft  systems,  including:  the  system  control  panels;  the  touch  control 
panel;  a  voice  interactive  control  panel;  and  a  multifunction  keyboard.  De¬ 
tailed  descriptions  of  these  different  components  and  the  different  concepts 
are  presented  in  Appendix  B.  A  summary  is  presented  in  the  following 
paragraphs: 

Basic  Concept  -  The  operation  of  the  basic  control  concept  is  presented  in 
Figure  3. 4. 2-1.  After  cancellation  of  the  master  alert  by  means  of  the  master 
caution/warning  switch,  the  procedures  and  status  displays  were  called  up 
automatically  for  warnings  and  by  using  the  line  select  function  for  alerts  of 
a  lower  urgency.  The  crew  performed  the  necessary  actions  on  the  systems 
control  panels  located  either  in  the  overhead  panel  or  the  central  pedestal. 
After  completion  of  the  checklist  procedures,  checklist  and  status  displays 
were  cleared,  and  the  message  was  removed  from  the  alert  display,  if  the 
alerting  situation  no  longer  exists.  If  the  alerting  situation  remained,  cau¬ 
tions  and  advisory  alerts  could  be  cleared  from  the  alert  display  by  selecting 
the  store  key. 

Touch  Panel  Interactive  Concept  -  This  concept  is  illustrated  in  Figure 
3. 4. 2-2.  In  this  concept  the  procedures  and  status  displays  were  also  called 
up  automatically  for  warnings  or  when  the  crew  selected  the  line  select  key 
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Figure  3. 4. 2-2.  The  Touch  Pane!  Interactive  Display  Concept 
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for  the  lower  urgency  alerts.  The  crew  performed  the  necessary  actions  on  the 
status  display  using  a  touch  panel  overlaying  a  schematic  diagram  of  the 
systems  involved.  Feedback  information  was  presented  on  both  the  procedures 
and  status  displays. 

The  touch  interactive  panel  overlaying  the  status  display  was  therefore  used 
to  control  the  aircraft  systems  in  lieu  of  using  the  aircraft  system  panels. 
The  touch  panel  used  two  sheets  of  plastic  with  embedded  conducting  strips 
separated  by  an  airspace.  Finger  pressure  forced  the  strips  to  make  contact. 
A  microprocessor  scaned  the  strips,  sensed  and  signaled  which  pair  of  strips 
were  in  contact. 

Multifunction  Keyboard  Concept  -  This  concept  used  the  multifunction  CDU  key¬ 
board  for  systems  control  (see  Figure  3. 4. 2-3),  and  its  display  for  presenting 
the  procedures,  and  it  used  the  status  display  for  status  information.  The 
crew  read  the  procedure  on  the  display  and  performed  the  actions  by  depressing 
the  "GO"  key  on  the  multifunction  keyboard.  Otherwise  the  sequence  was  the 
same  as  the  basic  and  touch  panel  concepts. 

The  multifunction  CDU  contains  a  matrix  of  15  multilegend  switches  and  a  flat 
panel  display  in  a  control  display  unit  configuration.  Each  switch  has  a  16 
by  35  dot  matrix  sunlight  readable  LED  display.  The  array  provides  a  resolu¬ 
tion  of  40  lines  per  inch  and  is  capable  of  providing  two  rows  of  six  5  by  7 
characters.  The  brightness  and  refresh  rate  are  under  software  control 
through  a  logic  and  refresh  control  unit. 

Voice  Interactive  Concept  -  Voice  presentation  was  used  for  alert  messages  and 
for  this  concept  voice  was  selected  to  control  the  FSM  displays  and  the  air¬ 
craft  systems  (see  Figure  3. 4. 2-4).  As  a  back-up,  both  displays  and  systems 
could  be  mapually  controlled  as  described  earlier.  By  selecting  the  voice  key 
on  the  alert  display,  the  voice  system  was  armed  and  voice  control  was  acti¬ 
vated  by  pushing  a  button  on  the  control  stick  and  saying  "voice  ready".  The 
crew  executed  an  action  by  depressing  the  button  again  and  saying  "GO".  Feed¬ 
back  was  presented  on  the  procedures  and  status  displays.  A  Texas  Instruments 
Command  System  was  used  for  voice  control.  This  system  combines  speech 
synthesis  and  recognition  into  a  single  unit.  The  speech  synthesis  compo- 
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nent  uses  a  linear  predictive  coding  algorithm  to  model  the  human  voice.  The 
voice  recognition  component  Is  speaker  dependent  and  must  be  trained  for  each 
user.  It  recognizes  connected  streams  of  words  allowing  the  pilot  to  use 
normal  sentences  to  Issue  commands. 

Automatic  Reconfiguration  Concept  -  Any  of  the  automated  or  system  aided  con¬ 
trol  concepts  could  incorporate  pilot-initiated  automatic  system  reconfigura¬ 
tion.  In  the  current  study,  the  multifunction  keyboard  concept  was  used  to 
evaluate  the  feasibility  of  the  automatic  control  method  (see  Figure 
3. 4. 2-5).  This  concept  requires  the  same  steps  to  call  up  the  checklist  on 
the  display  and  the  control  keys  on  the  keyboard.  However,  the  crew  had  to 
select  only  one  key  to  Initiate  the  corrective  action,  the  "EXEC"  key.  The 
system  automatically  performed  the  action  items  that  were  Interactive  with  the 
aircraft  systems  and  paused  at  Items  that  had  to  be  performed  by  the  crew. 
Feedback  was  presented  on  the  status  and  CDU  displays.  The  crew  had  the 
option  to  stop  the  reconfiguration  at  any  time. 

3.4.3  Flight  Scenario 

A  40-m1nute  navigation  scenario  was  developed  as  the  operational  route  (see 
Figure  3. 4. 3-1).  The  test  flight  began  on  the  segment  after  the  holding 
pattern  and  before  the  turn  toward  Paine  Airfield  and  lasted  approximately  20 
minutes.  The  pilot  used  the  available  minimum  of  flight  instrumentation  (see 
Section  3.4.5)  to  make  a  nonprecision  Instrument  approach  Into  Boeing  Field. 

3.4.4  Alert  Scenarios 

The  three  alert  scenarios  (i.e.,  differential  lift;  navigation  error;  and  re¬ 
jected  takeoff)  described  below  were  developed  to  evaluate  the  FSM  and  system 
display  and  control  concepts. 

The  differential  lift  scenario  was  used  as  the  test  scenario  while  the  navi¬ 
gation  error  scenario  was  used  for  training  and  the  rejected  takeoff  as  a 


denwnstration  of  a  progression  of  alerts  from  a  caution  "LOW  ACCELERATION"  to 
a  time-critical  warning  "TAKEOFF  ABORT". 

3. 4. 4.1  Differential  Lift  Scenario 

This  scenario  was  an  IFR,  non-precision  approach  into  SEATAC  under  adverse 
weather  conditions;  it  was  the  test  scenario.  To  provide  a  degree  of  realism 
the  scenario  included  several  alerts  which  led  to  a  differential  lift  critical 
condition  and  wing  stall.  The  sequence  of  events  was; 

1)  Activate  and  work  the  preliminary  landing  checklist 

2)  Left  engine  anti-ice  failure  under  icing  conditions  (caution) 

3)  Left  engine  failure  due  to  icing  (warning) 

4)  Activate  and  work  final  landing  checklist 

5)  Leading  edge  slats  asymmetry  (caution) 

6)  Wing  stall  (warning) 

7)  Stall  (time-critical) 

Figure  3. 4. 4-1  presents  a  graphic  representation  of  a  this  scenario. 

3. 4. 4. 2  Navigation  Error  Scenario 

This  scenario  occurred  in  the  holding  pattern  of  the  flight  scenario  and  was 
used  for  training.  The  aircraft  is  under  manual  control,  IFR  conditions 
exist,  and  turbulence  and  crosswinds  are  simulated.  The  scenario  included 
independent  alerts,  multiple  alerts,  an  engine  degrade  advisory  based  on  the 
prediction  of  an  "expert  system"  and  a  navigation  error  alert  which  degraded 
to  a  ground  proximity  time-critical  alert.  The  sequence  of  events  was: 

1)  Left  engine  degrade  predictive  alert  (advisory) 

2)  Left  engine  overheat  (caution) 

3)  Cabin  auto  inoperative  (caution)  and  left  engine  fire  (warning) 
multiple  alert 

4)  Navigation  error  (caution) 
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Figure  3. 4. 4-1.  Differential  Lift  Scenario 


5)  Navigation  error  (warning) 

6)  Ground  prox  (time-critical) 

A  graphic  representation  of  this  scenario  is  presented  in  Figure  3. 4, 4-2. 

3. 4. 4. 3  Rejected  Takeoff 

This  scenario  was  a  takeoff  from  initial  roll  to  climb  out.  However,  due  to 
slow  acceleration  the  FSM  simulated  alerts  required  the  pilot  to  reject  the 
takeoff  prior  to  rotation.  The  alerts  were  caused  by  low  acceleration  that 
could  have  been  due  to  a  number  of  factors  including  low  throttle  setting, 
snow  and  slush  on  the  runway,  low  tire  pressure,  up  slope  of  the  runway  and  an 
overladen  aircraft.  On  the  assumption  that  the  pilot  fails  to  abort  on  the 
first  alert  (caution),  the  alert  level  changed  as  the  aircraft  speed  appro¬ 
ached  The  rejected  takeoff  scenario  was  used  to  demonstrate  the  sequenc¬ 

ing  of  alert  urgency  level  as  the  time  to  respond  becomes  shorter.  It  was 
also  used  to  demonstrate  the  concept  of  an  “ABORT"  alert.  The  sequence  of 
events  after  the  aircraft  starts  to  roll  was: 

1)  Low  acceleration  (caution). 

2)  Low  acceleration  (warning). 

3)  Takeoff  abort  (time-critical). 

A  graphic  representation  of  the  scenario  is  presented  in  Figure  3. 4. 4-3. 
Since  the  alert  occurs  during  the  takeoff  role  no  checklist  or  status  infor¬ 
mation  were  provided. 

3.4.5  Evaluation  Procedures 

The  system  evaluation  was  performed  by  18  experienced  transport  pilots  who 
were  divided  into  10  two-man  crews  (two  of  the  pilots  had  to  fly  with  an  ob¬ 
server  pilot  as  the  nonflying  pilot  due  to  the  lack  of  a  second  crew  member). 
Each  crew  flew  four  training  and  four  test  scenarios  and  observed  one  demon¬ 
stration  scenario.  The  ten  flight  crews  flew  a  total  of  40  training  and 
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Figure  3. 4. 4-2.  Navigation  Error  Scenario 


40  test  flight  segments  and  observed  10  demonstration  scenarios.  The  order  of 
presentation  of  the  concepts  was  counterbalanced  between  the  crews  so  that  no 
crew  received  the  same  order  of  presentation.  This  was  done  in  an  attempt  to 
prevent  any  order  bias  from  confounding  the  results.  Prior  to  the  test  day, 
each  pilot  was  given  a  package  of  training  material.  This  package,  (Appendix 
B)  contained  a  graphic  presentation  of  each  concept,  operating  instructions, 
test  procedures,  and  a  test  schedule.  The  pilots  were  requested  to  review 
this  material  before  their  assigned  test  date. 

After  a  short  introductory  briefing  and  demonstration  of  the  facility,  the 
pilots  were  allowed  to  fly  the  flight  simulator  for  familiarization.  Training 
was  conducted  for  approximately  15  minutes  on  the  first  FSM  concept.  As  men¬ 
tioned  previously,  the  pilot  in  the  left  seat  flew  the  aircraft  and  operated 
the  FSM,  and  the  pilot  in  the  right  seat  observed  the  FSM  operation  and  evalu¬ 
ated  the  workload  imposed  by  the  system. 

At  the  beginning  of  each  test  trial,  the  pilots  were  informed  where  they  were 
in  flight  (i.e.,  approach  to  Boeing  Field).  The  established  crew  coordination 
procedure  for  the  test  was  that  the  non-flying  pilot  was  to  read  all  the 
action  items  from  the  checklist  and  act  as  a  second  observer  while  the  flying 
pilot  was  to  perform  all  the  actions.  The  flying  pilots  were  instructed  to 
respond  to  each  alert  as  they  would  in  actual  flight  operations  and  to  apply 
their  best  efforts  not  only  in  performing  the  response  task,  but  in  main¬ 
taining  their  flight  performance.  Since  the  simulation  had  no  outside  visual 
scene  and  a  minimum  of  flight  instrumentation  and  flight  aids,  the  pilot  was 
required  to  fly  the  designated  route  using  a  map  display  and  make  an  approach 
to  Boeing  Field.  The  instrumentation  that  was  available  to  the  pilot 
included:  a  Primary  Flight  Display  which  integrated  attitude,  flight  path, 
altitude  and  airspeed  information;  an  EHSI  which  consisted  of  a  map,  heading 
and  trend  information;  and  electronic  engine  instrumentation.  The  flight  con¬ 
trols  that  were  available  included:  a  center  stick  control;  rudder  pedals; 
throttle;  flap  control;  speed  brake;  and  the  various  trim  controls  and  system 
panels. 


At  the  completion  of  the  test  trials,  a  debriefing  questionnaire  was  adminis¬ 
tered  to  the  pilots  to  obtain  a  subjective  evaluation  of  the  FSM  design,  opera¬ 
tion  and  the  amount  of  work  required  to  operate  the  system  given  the  aircraft 
system  controls  that  they  just  flew.  The  questionnaire  is  presented  in 
Appendix  C.  At  the  completion  of  testing,  the  pilots  were  given  a  final  ques¬ 
tionnaire  which  allowed  them  to  make  comparisons  between  the  five  display  and 
control  concepts  and  evaluate  FSM  operations  (see  Appendix  D).  The  test  con¬ 
ductor  performed  an  informal  interview  which  allowed  the  pilots  to  expand  on 
their  questionnaire  inputs. 

3.4.6  Data  Measurement 

The  data  collected  during  the  evaluation  was  divided  into  two  general  cate¬ 
gories:  objective  data,  including  video  and  performance  recordings;  and  sub¬ 
jective  data,  including  the  questionnaires  and  the  debriefing. 

Objective  measures  were  the  time  required  to  perform  the  action  items  and  the 
pilot's  actions  in  operating  the  system.  The  pilot's  control  actions  were 
recorded  on  magnetic  tape  and  were  analyzed  to  obtain  tracking  performance  and 
the  time  and  sequence  of  discrete  actions.  A  videotape  record  was  made  to 
evaluate  the  sequence  and  the  time  of  events. 

Pilot  opinion  data  was  obtained  not  only  throughout  the  tests  by  voice  record¬ 
ing,  but  also  after  the  pilots  had  been  exposed  to  all  five  of  the  control  and 
display  concepts.  The  pilots  were  asked  to  rate  each  concept  on  an  absolute 
basis  after  they  had  finished  all  the  trials  on  that  concept.  This  rating 
included  questions  on  concept  operation  and  workload  as  compared  to  current 
practices.  At  the  completion  of  all  the  test  and  demonstration  trials,  each 
pilot  was  given  an  extensive  debriefing  questionnaire  wherein  they  were  asked 
to  rank  the  different  control  and  display  concepts  and  to  evaluate  the  FSM 
making  any  recommendations  or  changes  in  its  design  implementation  or  opera¬ 
tion. 


4.0  EVALUATION  RESULTS 


The  results  section  is  partitioned  into  two  general  sections,  one  addressing 
the  FSM  components  and  the  other  the  system  display  and  control  components. 
The  results  of  the  observational  and  pilot  opinion  data  are  based  on  operating 
the  FSM  for  540  crew  alerts  and  80  normal  procedures.  The  observational  data 
were  obtained  from  written  reports  of  the  onboard  observer  and  from  a  review 
of  the  video  tapes  recorded  throughout  the  test.  The  response  time  results 
were  derived  from  magnetic  tape  recordings  of  120  alerting  situations  and  40 
of  the  normal  procedures  encountered  during  the  test  flights. 

4.1  Flight  Status  Monitor  Components 

The  three  FSM  components  addressed  by  the  pilots  were:  the  alert  display;  the 
procedures  display;  and  the  status  display.  They  also  recommended  changes  to 
the  FSM  system  which  they  felt  would  make  it  more  compatible  with  the  opera¬ 
tional  environment. 

4.1.1  Alert  Display 

The  utilization  of  the  alert  display  was  consistent  with  the  results  of  pre¬ 
vious  alerting  studies  (Ref.  1,2,3).  The  pilots  used  this  display  to  identify 
the  specific  alert  that  had  occurred  and  to  determine  its  urgency  level.  Most 
of  the  pilots  (82%)  felt  that  the  information  provided  by  the  alert  display 
and  the  expected  crew  actions  were  clear  and  unambiguous.  After  obtaining  the 
information  from  the  display,  the  crews  proceeded  to  exercise  the  control  capa¬ 
bilities  of  the  system  by  line  selecting  the  "active"  alert  and  calling  up 
checklists  and  status  information.  Some  of  the  pilots  (18%)  reported  that 
they  at  times  were  confused  concerning  the  operation  of  the  FSM  controls. 
These  comments  were  concentrated  in  two  major  areas:  because  of  the  alternat¬ 
ing  line  select  keys  (odd  numbered  keys  on  the  left  and  even  on  the  right)  the 
appropriate  key  to  select  an  alert  was  not  always  apparent;  and  inclusion  of 
keys  which  operated  the  procedures  and  status  displays  on  the  alert:  w  display 
created  confusion  in  Identifying  control  functions. 


4.1.2 


Procedures  Display 


Observations  made  during  the  use  of  the  procedures  display  indicated  some 
areas  that  should  be  addressed  when  refining  the  FSM  system.  Although  all  of 
the  checklists  were  procedural ly  correct,  it  was  noted  that  in  some  cases  the 
crew  performed  unnecessary  actions  that  the  system  could  have  sensed  and  elimi¬ 
nated  (e.g.,  recalling  alerts  as  a  checklist  item  when  there  were  no  alerts  in 
memory).  The  system  provided  the  capability  to  skip  items  in  the  checklist  so 
that  the  crews  could  sequence  their  actions,  however,  they  could  not  return  to 
the  skipped  items  until  they  completed  the  rest  of  the  checklist.  This  fea¬ 
ture  in  some  cases  disrupted  the  esired  sequence.  Finally,  when  using  the 
monochromatic  procedures  display  (MFK  concept),  coding  the  completed  items 
with  a  symbol  resulted  in  increased  scanning  to  identify  the  completed  items 
and  the  current  action  item. 

Ninety-one  percent  of  the  pilots  felt  that  the  use  of  the  procedures  display 
was  much  better  than  using  the  Quick  Reference  Handbook  (QRH)  and  that  the  dis¬ 
play  should  be  used  for  both  normal  and  non-normal  checklists.  They  felt  that 
for  warning  and  caution  alerts  the  procedures  display  should  be  called  up  auto¬ 
matically  and  that  the  checklist  for  a  new  alert  should  be  integrated  with  any 
existing  checkl ist(s) .  When  a-'ed  if  the  display  could  be  used  for  functions 
other  than  FSM,  73  percent  of  the  pilots  indicated  that  the  display  should  be 
multifunction  on  a  noninterference  basis. 

Concerning  the  information  to  be  presented  on  the  procedures  display,  all  of 
the  pilots  felt  that  a  presentation  of  the  action  items  was  required  along 
with  some  indication  of  which  items  had  been  completed.  Further,  73  percent 
wanted  critical  information,  such  as  Min/Max  airspeeds  or  other  flight  limita¬ 
tions,  to  be  provided  as  part  of  the  checklist.  Eighty-two  percent  of  the  pi¬ 
lots  wanted  the  complete  page  on  the  display,  because  they  wanted  the  capabi¬ 
lity  to  page  through  and  read  the  checklist  before  taking  action.  All  pilots 
felt  that  a  page  indication  was  needed  for  multiple  page  procedures.  The  for¬ 
mat  requested  for  the  action  items  (91%  of  the  pilots)  was  a  reflection  of 
that  which  is  currently  most  common  with  the  system  related  words  on  the  left 
and  the  action  words  on  the  right,  e.g.,  LEFT  DEMAND  HYDRAULIC  PUMP . .ON. 


Eighty-nine  percent  of  the  pilots  said  that  it  was  essential  that  the  proce¬ 
dures  display  provide  them  feedback  as  they  were  performing  the  actions.  They 
ranked  color  coding  of  the  completed  items  as  the  most  preferred  method  of  pro¬ 
viding  this  feedback.  A  majority  of  the  pilots  (64%)  felt  that  the  coding 
used  in  the  test  was  appropriate  while  others  suggested  more  complex  schemes 
based  on  alert  urgency.  A  preference  for  color  coding  the  current  action  item 
rather  than  using  a  symbol  was  expressed  by  82  percent  of  the  pilots. 

A  voice  readout  of  the  checklists  was  not  desired  as  a  system  component:  56 
percent  did  not  want  this  feature  at  all  and  27  percent  said  that  if  it  were 
used  at  all  it  must  also  have  a  visual  display.  A  requirement  placed  on  any 
voice  readout  component  was  that  the  voice  message  match  any  visually  present¬ 
ed  message. 

4.1.3  Status  Display 

All  the  pilots  felt  that  the  aircraft  status  page  was  necessary  for  system 
operation  and  91  percent  felt  that  it  should  come  up  automatically  (64%  said 
before  doing  the  checklist  and  27%  said  after).  The  information  that  the 
pilots  felt  should  be  provided  by  the  aircraft  status  page  included:  opera¬ 
tional  status  of  the  gear,  brakes,  steering,  tires,  etc.  (73%);  operational 
status  of  the  engines  (82%);  and  any  operational  limits  (82%).  They  felt  that 
this  information  should  be  presented  in  the  form  of  either  a  combination  of 
written  lists  and  pictorials  (64%)  or  as  written  lists  alone  (35%).  This  in¬ 
formation  should  have  the  symbols  color  coded  according  to  alert  urgency  level 
and  present  quantitative  data  digitally. 

Eighty-two  percent  of  the  pilots  felt  that  the  failed  system  status  page  was 
at  least  beneficial  to  them  in  understanding  the  situation.  Seventy-three  per¬ 
cent  felt  that  schematics  with  written  text  should  be  used  to  present  the  in¬ 
formation.  They  also  felt  that  greater  levels  of  detail  should  be  available 
to  the  crew  upon  demand.  Again  the  pilots  preferred  that  symbols  or  charac¬ 
ters  be  color  coded  according  to  alert  urgency  (73%)  and  that  quantitative 
data  be  presented  digitally  (82%). 


The  perceived  benefit  of  the  status  display  was  highly  dependent  on  the  type 
of  aircraft  system  controls  being  employed.  If  the  status  display  was  requir¬ 
ed  to  operate  the  aircraft  systems  (Touch  Panel  concept),  then  all  the  crews 
perceived  the  display  as  a  benefit  to  their  response.  If,  on  the  other  hand, 
the  status  display  was  not  required  to  operate  the  systems  (Basic  concept), 
only  40  percent  of  the  pilots  felt  that  it  was  a  benefit  in  responding  to  the 
alerts.  Of  the  three  schematic  status  pages  (aircraft,  checklist  and  failed 
system),  the  majority  of  pilots  (82%)  wanted  to  see  the  aircraft  status  page 
first,  the  failed  system  status  page  second  and  the  checklist  status  page 
third  (if  at  all). 

4.1.4  Pilot  Recommended  Changes 

It  was  observed  that  of  all  the  status  information  available,  the  checklist 
status  page  and  its  operation  caused  the  most  concern  with  the  test  partici¬ 
pants.  This  page  of  information  was  not  consistently  used  by  any  of  the  pi¬ 
lots  and  some  crews  refused  to  use  it  even  with  prompting.  The  requirement  to 
manually  call  up  the  checklist  status  page  when  it  was  needed  to  perform  the 
action  items,  e.g.,  touch  panel  concept,  was  confusing.  The  crews  that  at¬ 
tempted  to  use  the  checklist  status  page  found  it  very  difficult  to  perform 
the  required  action  and  understand  the  schematic  in  the  one  second  delay  that 
was  built  into  the  system.  When  the  delay  was  changed  to  2.5  seconds,  this 
problem  was  alleviated.  Another  problem  that  was  encountered  with  this  page 
was  the  effect  of  delays  in  switch  actions  on  the  pilots'  responses.  Due  to 
transition  states  and  other  system  related  factors,  the  result  of  a  pilot 
action  was  at  times  not  immediately  apparent.  As  a  consequence  the  pilots  per¬ 
formed  multiple  button  pushes  during  these  delays.  It  was  also  observed  that 
at  times  the  crews  did  not  know  where  in  the  paging  sequence  they  were.  This 
was  attributed  to  the  lack  of  page  numbers  on  the  status  display  which  also 
resulted  in  some  of  the  crews  missing  the  additional  information  that  was 
available  for  some  alerts. 

All  pilots  had  the  opportunity  to  recommend  changes  to  the  FSM  system  which 
they  felt  would  improve  its  capability  and  acceptability  in  the  operational 
environment.  The  following  are  some  of  the  changes  that  were  recommended  by 
more  than  one  pilot: 


1)  Reduce  the  number  of  button  pushes  required  to  operate  the  FSM  thus 
reducing  the  pilot  workload  and  the  number  of  memory  items; 

2)  Improve  the  schematic  drawings  used  on  the  status  display,  the  infor¬ 
mation  should  be  presented  so  that  it  is  more  easily  understood  and 
in  a  standardized  manner; 

3)  Present  the  caution  checklists  automatically,  since  the  caution 
alert  requires  immediate  awareness,  the  crew  should  also  have  immed¬ 
iate  information  as  to  what  response  is  expected  of  them  so  they  can 
plan  their  actions; 

4)  Provide  a  dedicated  switch  for  each  status  page  so  that  the  crew  has 
direct  access  to  the  information  they  need  at  all  times  and  include 
page  numbers  on  the  status  pages  to  aid  the  crew  in  determining 
where  they  are  in  the  status  display  paging  scheme. 

4.2  Aircraft  System  Display  and  Control  Concepts 

The  methods  used  to  control  the  aircraft  systems  and  the  type  of  information 
available  for  display  by  those  systems  have  a  significant  impact  on  FSM  archi¬ 
tecture.  It  was  therefore  important  to  generate  data  on  how  the  FSM  was  used 
with  the  various  system  control  and  display  concepts  to  evaluate  their  viabi¬ 
lity  in  a  flight  deck  environment.  The  following  sections  present  the  pilot 
comparisons  and  evaluations  of  these  concepts  along  with  a  perceived  workload 
evaluation  and  some  performance  data. 

4.2.1  Basic  System  Panels 

All  of  the  pilots  felt  that  their  speed  in  responding  to  the  checklists  was 
affected  by  their  lack  of  familiarity  with  the  location  of  the  system  panels 
and  controls.  When  performing  the  action  items,  none  of  the  pilots  used  the 
checklist  status  page  with  the  basic  concept  without  prompting.  The  majority 
of  the  pilots  (73%)  questioned  the  necessity  of  presenting  the  checklist  sta¬ 
tus  information  at  all.  They  felt  that  it  was  not  natural  to  locate  a  control 


on  a  system  panel  then  look  to  another  display  for  feedback  while  activating 

that  control.  It  was  felt  that  this  process  would  Interfere  with  the  effi¬ 

cient  conduct  of  the  checklist.  What  the  pilots  wanted  to  see  on  the  status 
display  while  operating  the  basic  system  panels  was  a  presentation  of  the  in¬ 
formation  they  are  required  to  "check"  as  a  checklist  procedure,  e.g.,  fuel 
balance,  flap  position,  oil  pressure,  etc.,  and  an  Indication  of  the  effect 
that  their  actions  are  having  on  the  failed  system. 

4.2.2  Touch  Panel 

The  touch  panel  concept  presents  a  unique  set  of  FSM  design  problems.  Since 
the  checklist  status  page  is  required  to  operate  the  aircraft  systems,  the 
pilots  wanted  that  page  to  be  presented  automatically  rather  than  requiring  a 
manual  activation.  Sixty-seven  percent  of  the  pilots  wanted  the  area  to  be 
touched  to  lie  over  the  system  component  that  will  change  and  to  be  larger 
than  was  implemented.  All  of  the  pilots  wanted  the  area  that  they  had  to 
touch  to  be  highlighted  so  they  could  locate  It  quickly.  The  lack  of  this 
capability  was  one  of  the  major  contributing  factors  In  the  feeling  of  67  per¬ 
cent  of  the  pilots  that  the  schematics  provided  too  much  detail  to  be  effec¬ 

tive.  An  important  feature  of  the  touch  panel  to  56  percent  of  the  pilots  was 
consistency  between  the  checklist  and  the  schematics,  e.g.,  if  the  checklist 

item  reads  "LEFT  ENGINE  CUTOFF  SWITCH . CUTOFF"  the  touch  area  should  be 

over  a  switch  not  a  valve.  If  a  touch  panel  was  used  to  operate  the  systems, 
it  was  indicated  by  89  percent  of  the  pilots  that  the  switch  used  to  designate 
the  completion  of  manual  tasks  (the  "DONE"  switch)  should  be  presented  on  the 
touch  area.  Fifty-six  percent  of  the  pilots  further  stated  that  the  dedicated 
system  panels  could  not  be  eliminated  by  the  touch  panel.  Finally,  67  percent 
of  the  pilots  questioned  the  effect  of  turbulence  on  switch  activation  errors, 
especially  if  the  touch  panel  Is  located  where  the  crew  has  to  reach  to  make 
an  input.  They  felt  that  the  location  of  the  touch  panel  could  be  improved 
for  both  visibility  and  reach. 

4.2.3  Voice  Control 

In  order  to  achieve  high  accuracy,  voice  control  systems  require  a  training 
regime  that  was  out  of  the  scope  of  the  present  test  effort.  Therefore,  all 


of  the  pilots  were  frustrated  by  the  fact  that  the  system  did  not  recognize 
their  commands  with  what  they  considered  an  adequate  level  of  consistency. 
One  important  restriction  that  current  voice  control  systems  places  on  its 
operator  is  that  a  specific  set  of  words  must  be  used  in  a  specific  order  for 
the  system  to  function.  Fifty-six  percent  of  the  pilots  commented  that  they 
were  not  always  sure  what  words  the  system  expected  them  to  use.  Recause  of 
these  factors,  67  percent  of  the  pilots  felt  that  it  would  be  more  efficient 
to  do  the  actions  manually  rather  than  with  voice  control  and  they  felt  that 
voice  control  should  not  be  used  for  this  purpose. 

However,  if  voice  control  was  going  to  be  used  for  system  reconfiguration,  all 
of  the  pilots  said  that  it  must  be  used  in  conjunction  with  some  form  of 
manual  control.  The  functions  most  often  mentioned  as  being  amenable  to  voice 
control  were:  controlling  the  status  display  (73%  of  the  pilots);  controlling 
the  checklist  display  (64%);  and  performing  checklist  action  items  (55%). 

4.2.4  Multifunction  Keyboard  Control 


When  using  the  multifunction  keyboard  to  reconfigure  (with  the  press  of  the 
"GO"  button)  the  aircraft  systems,  it  was  necessary  to  select  which  checklist 
items  can  be  accomplished  from  the  keyboard  (e.g.,  turn  seatbelt  sign  on, 
start  the  API),  etc.)  and  which  require  manual  crew  action  (e.g.,  primary 
flight  controls,  gear,  fire  handle,  etc.).  A  problem  arises  in  distinguishing 
between  the  two  types  of  action.  Sixty-seven  percent  of  the  pilots  commented 
that  without  using  the  checklist  status  page  they  could  not  make  the  distinc¬ 
tion  between  the  two  and  would  prefer  that  this  information  be  coded  into  the 
checklist  display.  Most  of  the  pilots  (82%)  expressed  difficulty  in  distin¬ 
guishing  between  completed  and  incompleted  action  items  on  the  monochromatic 
display,  especially  when  some  items  were  skipped.  They  also  felt  that  it  took 
much  longer  to  find  the  current  action  item  on  the  monochromatic  display  than 
it  did  on  the  color  display.  In  order  to  verify  their  keystrokes  and  asso¬ 
ciate  them  with  the  active  line  of  the  checklist,  82  percent  of  the  pilots 
wanted  the  active  checklist  item  to  be  repeated  on  the  multilegend  key  face. 


4.2.5 


Automatic  Reconfiguration 


The  major  concern  of  all  the  pilots  regarding  automatic  reconfiguration  was 
reliability.  As  with  any  other  automatic  system,  it  must  have  a  very  low  prob¬ 
ability  of  failure  before  the  pilots  will  feel  comfortable  about  using  it. 
Another  major  concern  of  the  pilots  was  the  question  of  who  had  the  responsi¬ 
bility  for  performing  what  actions  (pilot  vs.  automatic)  and  who  is  going  to 
ma'<e  the  task  assignments.  It  was  the  general  feeling  that  the  pilots  should 
have  the  responsibility  for  the  major  action  items  (flight  controls,  fire  han¬ 
dle,  engine  shutdown,  etc.)  and  the  automatic  system  for  "clean-up"  functions 
(e.g.,  APU  start,  isolation  valves,  etc.).  This  philosophy  was  reflected  in 
the  features  that  the  pilots  wanted  to  see  in  an  automatic  system  which  in¬ 
clude:  the  automatic  system  stopping  before  critical  action  items  (100?;  of  the 
pilots);  ability  to  stop  the  sequence  manually  at  any  time  (02%);  selection  of 
the  automatic  function  should  be  a  crew  option  (73%);  the  automatic  sequence 
should  stop  when  a  new  alert  occurs  (73%);  and  system  status  should  be  present¬ 
ed  which  reflects  any  reconfiguration  (73%).  After  reviewing  the  automatic 
concept,  56  percent  of  the  pilots  volunteered  that  they  felt  it  would  be  a 
means  to  eliminate  errors  in  doing  the  checklists.  Further  study  of  the  cri¬ 
teria  for  selecting  automatic  tasks  was  suggested. 

4.2.6  Subjective  Comparison  of  the  Concepts 

The  pilots  were  asked  to  evaluate  the  system  display  and  control  concepts  on  a 
number  of  different  criteria  and  then  to  take  a  specific  set  of  these  criteria 
and  rank  order  the  concepts.  Figure  4. 2. 6-1  presents  graphically  the  evalua¬ 
tion  data  in  the  form  of  average  pilot  ratings.  These  data  indicate  that, 
with  the  exception  of  voice  control,  all  the  concepts  were  rated  above  average 
(i.e.,  above  5.0)  on  all  criteria.  Due  to  operational  difficulties,  voice  con¬ 
trol  was  rated  below  average  on:  the  acceptability  of  the  concept  (4.4);  the 
implementation  in  the  simulator  (4.9);  its  ease  of  use  (4.5);  its  potential 
for  error  reduction  (4.5);  and  its  compatibility  with  the  operational  environ¬ 
ment  (3.8).  All  the  other  concepts  received  the  same  general  ratings  across 
the  criteria.  The  rating  trend,  however,  consistently  placed  the  automatic 
reconfiguration  concept  higher  on  the  scale  than  the  others.  This  was  espec¬ 
ially  true  for  the  following:  its  ease  of  use  (8.0);  its  potential  for  error 
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reduction  (8.4);  the  time  required  to  complete  operations  (9.3);  the  complex¬ 
ity  of  operating  the  system  (8.6);  the  number  of  actions  required  to  complete 
an  operation  (9.0);  and  the  number  of  memory  items  needed  to  operate  the  sys¬ 
tem  (9.1).  The  highest  average  rating  was  received  by  the  automatic  concept 

(9.3)  for  the  time  required  to  perform  the  operations  and  the  lowest  by  the 
voice  concept  (3.8)  for  its  compatibility  with  the  operational  environment. 

One  measure  of  the  strength  of  the  pilots'  feelings  concerning  the  display  and 
control  concepts  is  the  variability  of  their  ratings  (i.e.,  how  well  they 
agreed  with  each  other).  In  reviewing  the  data  (Table  4. 2. 6-1),  the  highest 
level  of  agreement  among  the  pilots  (lowest  standard  deviation)  was  the  auto¬ 
matic  concept  (overall  standard  deviation  1.4)  and  the  basic  concept  (1.7)  and 
the  lowest  for  the  voice  control  concept  (2.7). 

Using  the  criteria  listed  in  Figure  4. 2. 6-2,  the  pilots  ranked  all  the  con¬ 
cepts  on  a  scale  where  a  rank  of  5  was  the  most  preferred  and  1  the  least. 
These  rankings  followed  the  same  pattern  as  the  ratings.  The  automatic  recon¬ 
figuration  concept  was  the  most  preferred  concept  for  the  following  criteria; 
its  ease  of  use  (average  rank  of  4.5);  its  potential  for  error  reduction 

(4.3) ;  its  ease  of  training  (4.2);  and  its  overall  operability  (4.1).  The 
voice  control  concept  was  least  preferred  for  the  following  criteria;  its  ease 
of  training  (1.7);  its  overall  operability  (2.1);  its  overall  desirability 
(2.0)  and  the  overall  preference  (2.0).  The  basic  concept  ranked  just  below 
the  automatic  concept  in  its:  potential  for  reducing  errors  (3.4);  and  ease  of 
training  (3.6).  All  other  rankings  were  essentially  equal.  Furthermore,  the 
variability  of  the  rankings  was  much  more  consistent  across  the  concepts  than 
was  the  variability  for  the  ratings.  The  most  variable  concepts  basic  (over¬ 
all  standard  deviation  1.3)  and  automatic  (1.3)  were  only  one  tenth  of  a  rank¬ 
ing  position  greater  than  voice  (1.2)  and  two  tenths  greater  than  multifunc¬ 
tion  (1.1)  and  touch  (1.1). 

4.2.7  Perceived  Workload 

The  pilots  were  asked  to  compare  the  workload  imposed  by  the  test  systems  to 
their  current  flight  operations  on  a  7  point  scale  where  the  low  end  of  the 
scale  (1)  meant  that  the  new  concepts  are  much  harder /worse  than  the  current 
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Table  4. 2.6-1.  Mean  and  Standard  Deviations  of  the  Pilot  Evaluation 
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operation  and  the  high  end  (7)  meant  that  the  new  concepts  are  much  easier/ 
better.  The  interpretation  of  the  results  of  this  area  of  questioning  must  be 
made  realizing  that  the  operating  procedure  of  the  test  which  required  the  fly¬ 
ing  pilot  to  perform  the  action  items  is  not  realistic  in  an  operational 
sense.  Operationally  the  action  items  would  be  split  between  the  flying  and 
non-flying  pilots.  Therefore,  the  test  procedures  as  flown  may  have  had  the 
effect  of  artificially  increasing  perceived  workload.  Even  with  this  design 
artifact,  all  of  the  system  control  concepts  had  an  average  rating  indicating 
that  they  were  easier/better  than  current  system  operation  (Figure  4. 2. 7-1). 
The  results  from  the  individual  pilot  groups  reflect  the  airline  pilots  consis¬ 
tently  rated  the  workload  of  the  control  concepts  as  easier  than  their  present 
operations  while  the  certification  pilots  rated  it  the  same  or  harder. 

Figure  4. 2. 7-2  presents  the  criteria  that  were  used  to  estimate  workload. 
These  results  reflect  the  effect  of  having  the  flying  pilot  perform  all  the 
action  items  as  can  be  seen  with  the  lowest  ratings  for  each  concept  being  the 
ability  to  maintain  piloting  functions  and  the  overall  workload.  Except  for 
these  two  criteria  all  other  ratings  indicated  that  the  test  concepts  were 
easier /better  than  current  operations. 

The  comments  by  the  majority  of  the  pilots  (i.e.,  all  comments  were  given  by 
more  than  50%  of  the  tested  pilots;  some,  however,  may  have  a  higher  percen¬ 
tage)  concerning  the  workload  imposed  by  the  test  concepts  indicate  that  they 
want  to  divide  the  performance  of  the  action  items  so  that  the  flying  pilot 
would  do  those  items  related  to  aircraft  control  and  the  non-flying  pilot 
would  perform  system  control  items.  They  also  felt  that  unfamiliarity  with 
the  simulated  aircraft,  the  FSM  and  the  system  controls,  resulted  in  an  in¬ 
crease  in  their  perceived  workload.  They  felt  that  the  number  of  pilot  ac¬ 
tions  to  operate  the  system,  e.g.,  button  pushes  to  display  a  caution  check¬ 
list,  button  pushes  to  page  through  the  status  information,  sequencing  status 
pages,  etc.,  produced  unnecessary  workload.  The  feeling  was  expressed  that 
some  of  these  unnecessary  actions  could  be  eliminated  by  automating  some  of 
the  FSM  functions  such  as  displaying  the  checklist  for  cautions  without  re¬ 
quiring  a  line  select  and  automatically  sequencing  to  the  appropriate  status 
page.  The  use  of  the  checklist  status  page  was  also  seen  as  an  unnecessary 


addition  to  the  workload.  The  pilots  expressed  the  feeling  that  they  did  not 
want  or  need  that  information; 

Conversely,  the  pilots  felt  that  the  display  of  the  checklist  significantly 
decreased  their  workload.  Color  coding  the  action  items  decreased  the  time  to 
scan  the  display  and  also  the  mental  effort  required  to  keep  track  of  the 
whole  response  process.  Centralization  of  the  information  (both  procedural 
and  status)  reduced  overall  scanning  and  permitted  the  crew  to  get  all  the  per¬ 
tinent  information  in  one  location. 

4.2.8  Pilot  Performance 

A  measure  of  the  effectiveness  of  a  control  concept  is  the  time  taken  to  per¬ 
form  the  required  action  items  using  that  concept.  Figure  4. 2. 8-1  graphically 
presents  the  performance  data  from  the  test  scenario  for  the  four  tested  con¬ 
cepts  (basic,  voice,  touch  and  MFK)  and  an  analytic  number  for  the  automatic 
system.  The  value  for  automatic  performance  was  derived  using  a  value  of  2.5 
seconds  for  system  functions  (the  time  it  took  the  system  to  perform  the 
action  steps)  and  10  seconds  for  pilot  action  items  (an  average  time  for  pilot 
"check"  actions).  From  the  data,  it  can  be  seen  that  the  time  used  to  com¬ 
plete  action  items  is  dependent  on  both  the  variables  being  examined,  i.e., 
alert  urgency  and  system  control  concept. 

The  data  from  the  present  study  (Table  4. 2. 8-1)  were  consistent  with  previous 
alerting  system  research  (Ref.  1,2,3)  in  that  the  alert  urgency  had  a  direct 
relationship  to  the  speed  in  which  the  pilot  responded.  The  overall  average  re¬ 
sponse  time  to  perform  the  action  items  in  the  warning  checklist  (8.5  seconds) 
was  faster  than  that  for  cautions  (10.5  seconds)  and  both  were  faster  than  nor¬ 
mal  checklist  items  (12.5  seconds).  As  would  be  expected  the  automatic  system 
resulted  in  the  fastest  response  for  all  types  of  checklist.  In  performing 
the  normal  checklists  the  touch  concept  producing  a  slightly  faster  average 
time  (12.8  seconds)  per  action  item  than  the  MFK  (14.1  seconds)  basic  (14.6 
seconds)  or  voice  (14.8  seconds)  concepts.  Performance  of  the  abnormal  check¬ 
lists  resulted  in  some  definite  trends  with  voice  control  exhibiting  the  slow¬ 
est  average  item  response  times  for  both  warnings  (10.8  seconds)  and  cautions 
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.. 

(13.3  seconds)  and  the  multifunction  keyboard  the  fastest  (7.7  and  9.9  sec¬ 
onds,  respectively). 

Except  for  the  voice  control  concept  which  was  affected  by  errors  In  recogni¬ 
tion,  the  variability  of  response  was  In  a  range  of  a  1.3  seconds  standard  de¬ 
viation  for  using  touch  panel  with  a  normal  checklist  and  using  the  basic  sys¬ 
tem  panels  for  the  warning  checklist  to  2,8  seconds  standard  deviation  for  us¬ 
ing  the  basic  and  MFK  concepts  with  the  caution  checklist.  The  completion  of 
the  caution  checklist  produced  the  highest  variability  with  an  average  stan¬ 
dard  deviation  of  3.1  seconds  and  warning  checklists  the  lowest  at  1.7  seconds. 
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5.0  DISCUSSION  AND  CONCLUSIONS 


The  ability  of  the  flight  status  monitor  to  provide  guidance  and  feedback 
along  with  the  alerting  functions  offers  the  potential  of  enhancing  aircraft 
safety  by  improving  the  effectiveness  of  the  flight  crews  in  both  normal  and 
non-normal  situations.  It  achieves  this  potential  by  reducing  the  probability 
of  error,  the  time  to  respond  and  the  perceived  workload  while  making  more  of 
the  crews'  channel  capacity  available  for  flying  the  aircraft.  The  following 
sections  will  discuss  the  study  findings  for  each  FSM  component  and  relate 
them  to  system  implementation. 

5.1  Alert  Display 

Because  of  its  central  location  and  coding  of  the  information,  this  display 
was  seen  as  facilitating  the  pilot  response  to  alerts.  This  component  of  the 
FSM  provides  the  means  for  the  crew  to  determine  "what"  is  wrong  and  there¬ 
fore,  it  must  be  designed  to  transfer  that  information  effectively.  There  was 
nothing  in  the  present  test  that  indicated  that  the  guidelines  for  the  alert 
display  established  in  the  Alerting  Systems  Standardization  Study  (Ref.  3) 
should  be  changed. 

In  the  flight  operations  environment  it  is  necessary  for  the  crew  to  interact 
with  the  FSM  alert  component.  The  controls  required  for  this  crew  interac¬ 
tion  include:  a  method  of  storing  caution  and  advisory  alerts  that  remain 
after  working  their  checklists;  a  method  of  recalling  stored  alerts;  a  method 
of  paging  the  display  when  the  number  of  alerts  exceeds  the  capacity  of  a 
single  page;  and  the  capability  of  selecting  a  specific  alert(s)  to  perform 
some  system  action,  e.g.,  call  up  the  checklist,  get  handbook  information, 
perform  a  selective  store,  etc.  If  the  method  of  selecting  a  specific 
alert(s)  is  via  switches  located  next  to  the  line  to  be  selected,  then  some 
cue  should  be  used  to  make  it  very  clear  what  alert  line  goes  with  what  switch. 

5.2  Procedures  Display 

Almost  all  of  the  pilots  tested  noted  the  benefit  of  the  procedures  display  in 
working  both  normal  and  non-normal  checklists.  They  preferred  it  to  the  Quick 


Reference  Handbook,  because  it  aided  them  in  performing  the  procedure  by  pre¬ 
senting  the  appropriate  steps  and  keeping  track  of  what  had  been  accomplished. 
This  display  therefore,  was  identified  as  a  necessary  component  of  the  flight 
status  monitor  with  the  function  of  providing  the  majority  of  the  guidance 
information. 

The  results  indicate  that  the  pilots  want  to  use  the  checklists  to  plan  their 
course  of  action.  In  order  to  accomplish  this  planning,  the  complete  check¬ 
list  of  action  items  and  relevant  flight  information  (e.g.,  diversions,  flight 
limitations,  max  speeds,  min  speeds,  etc.)  should  be  available  for  pilot  ro- 
view.  In  current  operation  the  handbook  checklists  are  generally  formatted  so 
that  the  action  system  is  on  the  left  and  the  action  step  is  on  the  right, 
e.g.,  LEFT  DEMAND  HYDRAULIC  PUMP . ON.  This  same  format  was  consid¬ 

ered  appropriate  for  the  procedures  display  because  of  its  familiarity  and  the 
fact  that  it  fits  the  way  the  crews  communicate  the  action  items. 

In  operating  the  FSM,  the  crews  identified  an  additional  set  of  information 
that  they  felt  should  be  included  on  the  display  in  order  for  them  to  effec¬ 
tively  respond  to  the  checklists.  They  felt  that  the  display  should  provide 
an  indication  of:  the  alert(s)  being  addressed  and  its  (their)  urgency  level; 
whac  page  is  currently  being  displayed;  which  action  item  is  the  next  one  to 
be  accomplished;  and  which  action  items  have  been  completed  or  are  currently 
in  transit.  In  order  for  the  pilot  to  know  that  the  system  is  operating,  the 
indication  of  a  completed  action  or  an  "in  transit"  item  should  be  made  in  as 
short  a  time  frame  as  possible.  If  these  indications  take  longer  than  0.5  sec¬ 
onds,  the  pilot  will  have  a  tendency  to  perform  the  action  again.  He  will 
.also  feel  that  the  system  is  too  slow  for  effective  checklist  performance.  In 
some  cases  the  pilot  will  perform  or  may  have  already  performed  some  of  the 
required  actions  before  looking  at  the  checklist.  In  these  instances,  the 
items  shoi’d  be  identified  as  completed.  Almost  all  the  pilots  felt  that  the 
feedback  provided  by  these  indicators  was  essential  for  system  operation  and 
that  color  coding  was  the  preferred  method  of  providing  the  feedback  where 
appropri ate. 

Since  it  is  a  computer  based  (and  most  likely  artificial  intelligence  based) 
system,  the  FSM  should  have  the  capability  to  formulate,  integrate  and  modify 
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checklists  according  to  the  situation.  Because  of  the  requirement  to  have  all 
the  checklist  steps  available  for  the  crew  to  review,  it  is  very  impo  nt 
that  the  checklist  be  limited  to  only  those  actions  which  are  necessary.  The 
crews  expressed  concern  that  a  sophisticated  information  system  would  not  be 
able  to  tailor  the  checklists  to  the  specific  situations.  The  FSM  should  have 
the  capability  to  eliminate  unnecessary  action  items  from  the  checklist,  for 

example,  the  action  item  "ALERTS . RECALL"  is  not  necessary  if 

there  are  no  alerts  in  the  FSM  memory.  Because  the  current  method  of  presen¬ 
ting  checklists  is  not  dynamic,  statements  are  used  to  accommodate  all 

contingencies,  for  example,  "IF  ALTIiUDE  BELOW  35000  FEET,  APU . START". 

These  kind  of  statements  should  not  be  required  on  the  FSM,  because  the  system 
is  monitoring  aircraft  parameters  and  can  determine  the  appropriate  action 
statement.  Finally,  when  situations  occur  that  cause  multiple  che:klists,  the 
system  should  have  the  capability  to  integrate  those  checklists,  prioritizing 
the  action  items,  and  eliminating  duplication. 

The  guidance  component  display  characteristics  should  follow  the  design  guide¬ 
lines  documented  in  the  Aircraft  Alerting  Systems  Standardization  Study  (Ref. 
3).  Although  voice  presentation  is  recommended  when  rapid  response  is  required 
and  it  does  transfer  workload  from  the  visual  to  the  auditory  channel,  the 
system  designer  must  be  aware  of  the  serial  presentation  requirements  of  the 
auditory  channel.  A  large  body  of  research  has  shown  the  significant  poten¬ 
tial  for  the  interference  between  different  voice  sources.  The  majority  of 
the  pilots  recommended  that  voice  read-out  of  the  action  items  not  be  included 
as  a  system  capability.  The  pilots  that  were  tested  did  feel  that  the  proce¬ 
dures  display  could  be  used  for  other  display  functions  as  long  as  it  was  on  a 
noninterference  basis. 

In  order  for  the  crew  to  interact  with  the  guidance  component,  the  system  con¬ 
trols  should  provide  the  capability  to:  select  checklists  not  only  for  the  cur¬ 
rent  alerts,  but  also  normal  procedures  associated  with  the  current  flight 
phase  and  any  other  normal  or  non-normal  procedure  that  the  crew  wishes  to  re¬ 
view  to;  page  the  checklists  forward  and  reverse  in  order  to  accommodate  those 
procedures  which  require  more  than  one  page;  of  selecting  a  different  sequence 
of  action  based  on  their  knowledge  of  the  situation  by  moving  the  current 
action  item  indicator  up  and  down;  and  to  signal  the  completion  of  action 
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items  which  the  system  expects  the  pilot  to  perform,  e.g.,  check  seatbelt  an-l 
shoulder  harness. 

5.3  Status  Display 

The  results  indicate  that  the  status  display  is  beneficial  to  the  operation  of 
the  flight  status  monitor.  The  status  display  provides  the  majority  of  th^ 
FSM  feedback  function  by  presenting  the  crew  with  an  indication  of  the  overall 
status  of  their  aircraft  as  well  as  informing  them  of  the  status  of  failed  sys¬ 
tems  and  providing  handbook  information  for  dealing  with  non-normal  situa¬ 
tions.  The  requirement  for  presenting  the  schematic  which  corresponds  to  the 
current  action  item  of  the  checklist  (checklist  status  page)  is  dependent  upon 
the  type  of  aircraft  system  controls  being  employed. 

All  the  crews  that  were  tested  felt  that  the  aircraft  status  information  was 
necessary  for  system  operations.  The  aircraft  status  page  should  be  used  to 
present  any  operational  limitation  of  the  aircraft  as  well  as  the  status  of 
engines,  flight  control  surfaces,  gear,  brakes,  steering,  and  tires.  This 
page  should  activate  automatically  when  a  non-normal  situation  occurs  which 
requires  immediate  attention  or  action.  It  may  be  presented  automatically  at 
flight  phase  changes  and  should  be  available  at  all  times  for  manual  activa¬ 
tion.  The  information  on  the  page  should  be  continuously  updated  so  that  the 
crew  can  obtain  current  status  without  any  additional  actions. 

The  format  of  the  aircraft  status  display  is  very  important  relative  to  the 
amount  of  information  that  is  transferred  to  the  crew.  Recause  of  the  amount 
and  type  of  information  to  be  included  on  the  aircraft  status  page,  both  alpha- 
numerics  and  graphic  techniques  are  appropriate.  The  use  of  graphics  facili¬ 
tates  the  rapid  presentation  of  a  large  quantity  of  disparate  information  in  a 
limited  space  while  promoting  situational  awareness.  Research  has  shown  that 
pilots  can  interpret  properly  constructed  graphics  quicker  than  corresponding 
written  material  (Ref.  2,4).  The  pilots  indicated  that  as  an  aid  to  intnrprp- 
tation  the  graphic  presentation  should  be  color  coded  and  the  code  should  in¬ 
clude  an  indication  of  the  alert  urgency.  There  is  however,  some  information 
that  is  more  amenable  to  alphanumeric  presentation  such  as  max/min  limita¬ 
tions,  special  instructions  (e.g.,  avoid  icing),  and  quantative  information. 
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Any  quantitative  information  that  is  provided  should  be  in  digital  form  unless 
the  crew  requires  some  sense  of  rate  or  more  situational  awareness  than  an 
analog  presentation  would  be  more  appropriate. 

The  faileff  system  status  page  is  the  next  level  of  detail  in  a  non-normal  situ¬ 
ation.  It  is  used  to  provide  the  crew  a  more  comprehensive  understanding  of 
the  situation.  At  the  top  level  the  information  should  make  the  crew  aware  of 
the  system  that  has  failed  and  its  effect  on  other  major  aircraft  systems, 
e.g.,  flow  diagram,  pressures,  temperatures,  electrical  output,  etc.  Again 
the  failed  system  status  should  be  presented  both  graphically  and  alphanumer- 
ically  with  the  symbols  or  characters  color  coded  according  to  alert  urgency 
and  quantitative  information  in  digital  form.  There  may  be  some  situations 
which  require  more  detail  about  the  failure  for  the  crew  to  respond  effective¬ 
ly.  The  FSM  therefore,  should  have  the  capability  to  present  levels  of 
greater  detail  about  the  failed  system  upon  crew  request. 

The  information  pages  of  the  status  display  provide  the  crew  with  supplemental 
information  from  the  flight  manual  about  non-normal  situations.  Operationally 
the  crews  used  this  page  after  they  had  completed  the  checklist  and  had  the 
situation  stabilized.  The  time  pressure  for  using  the  information  presented 
on  the  information  page(s)  is  relatively  low  since  it  is  not  required  to  res¬ 
pond  to  the  alert.  Therefore,  alphanumeric  presentation  of  the  information  is 
appropriate.  Because  it  is  supplpmental  information,  there  is  no  need  to 
bring  it  up  automatically,  but  it  should  be  available  whenever  the  crew  wants 
to  activate  it  manually. 

The  checklist  status  page  resulted  in  the  most  variability  among  the  crews  in 
their  operation  of  the  system.  While  some  crews  used  it  under  protest,  others 
refused  to  use  it  at  all  except  to  operate  the  touch  panel.  The  complaints 
centered  around  the  usefulness  of  the  information  for  any  of  the  aircraft  sys¬ 
tem  control  concepts  (except  for  the  touch  panel)  and  that  it  was  a  waste  of 
time  trying  to  determine  what  was  being  presented  while  they  were  trying  to 
work  through  the  checklist.  If  the  controls  require  interaction  with  thp  sta¬ 
tus  display,  i.e.,  touch  panel,  then  the  checklist  status  page  is  necessary. 


However,  this  page  should  not  he  used  unless  it  is  required  for  aircraft  sys¬ 
tem  control.  If  the  checklists  status  page  is  required  to  operate  the  air¬ 
craft  systems,  then  every  effort  should  be  made  to  make  the  crew  responses 
accurate  and  timely.  The  status  page  should  be  activated  automatically  with 
the  diagrams  sequencing  with  the  action  items  on  the  checklist.  Information 
that  the  pilot  needs  to  accomplish  "check"  items,  e.g.,  fuel  balance, 
altimeter,  etc.,  and  a  control  that  is  used  by  the  pilots  to  indicate  the 
completion  of  their  action  items  should  be  included  on  the  checklist  status 
page.  The  results  of  the  crew  actions  should  be  quickly  presented  (less  than 
0.5  seconds)  on  the  status  display.  The  diagrams  should  remain  long  enough 
after  each  action  for  the  pilot  to  observe  the  results  of  his  action. 
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As  the  feedback  component  of  the  flight  status  monitor,  the  status  display 
should  have  characteristics  which  are  in  accordance  with  the  guideline  present¬ 
ed  in  the  Aircraft  Alerting  Systems  Standardization  Study  (Ref.  3).  All  of 
the  features  of  the  display  should  be  designed  to  facilitate  the  transfer  of 
the  highly  complex  information  concerning  the  aircraft  and  aircraft  systems 
status  to  the  crew  in  an  effective  manner.  Color  was  the  preferred  method  of 
coding  the  information.  Schematics  and  graphics,  when  conbined  with  a 
selective  use  of  alphanumeri cs ,  was  the  format  that  most  effectively 
transmitted  the  desired  information.  Because  of  the  number  of  different  types 
of  information  available  on  the  status  display,  each  page  should  be  clearly 
labeled  to  permit  easy  access.  The  sub-pages  should  also  be  labeled  so  that 
the  crew  can  immediately  determine  what  page  is  being  presented. 

For  the  crew  to  interact  with  the  feedback  component,  the  system  controls 
should  provide  the  capability  to:  activate  the  status  display  at  any  time 
during  the  flight  so  that  the  crew  can  tailor  their  information  gathering  to 
the  flight  situation;  select  the  particular  status  page  that  is  required  with¬ 
out  unnecessary  button  pushes,  thus  reducing  the  crew  workload  encountered  in 
using  the  system;  page  through  the  sub-pages  to  obtain  all  the  available  infor¬ 
mation;  and  to  select  greater  detail  on  the  failed  system  status  page,  fiiven 
these  controls  the  crew  should  he  able  to  utilize  the  status  display  to  its 
fullest  capability. 
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5.4  Aircraft  System  Controls 

During  the  study,  the  flight  status  monitor  was  combined  with  five  different 
concepts  for  controlling  the  aircraft  systems.  The  combination  demonstrated 
that  the  design  of  the  FSM  is  effected  by  the  system  control  concept  being  em¬ 
ployed.  Because  system  control  is  so  aircraft-design  specific,  the  FSM  must 
be  designed  to  accommodate  a  wide  range  of  design  concepts.  Furthermore,  the 
advanced  technology  used  to  operate  the  aircraft  systems  is  applicable  for  use 
as  system  control  for  the  FSM. 


6.0  RECOMMENDATIONS  FOR  FUTURE  ACTIVITY 


6.1  FSM/Pilot  Interface 

The  Phase  I  and  II  efforts  have  identified  a  number  of  issues  concerning  the 
flight  status  monitor  pilot  interface  which  need  to  be  resolved  before  any 
meaningful  guidelines  can  be  written.  Table  6.1-1  presents  a  partial  list  of 
these  issues.  One  of  the  objectives  of  any  future  program  activity  should  be 
to  resolve  these  issues  in  an  integrated  testing  activity.  One  of  the  major 
activities  of  such  an  effort  would  be  the  investigation  of  the  time-critical 
alerts.  The  near-term  requirements  for  additional  time-critical  alerting  capa¬ 
bility  for  collision-avoidance,  windshear,  takeoff  abort,  and  perhaps  active 
control (s)  failures  are  becoming  more  pressing.  Previous  research  has  shown 
that  the  manner  in  which  this  type  of  information  is  presented  to  the  pilot  is 
critical.  Improperly  designed  displays  can  confuse  and  impede  pilot  response, 
whereas  properly  designed  displays  can  elicit  rapid  and  accurate  responses. 
Identification  of  the  proper  display  location  (dedicated  display  vs.  elec¬ 
tronic  flight  instruments)  and  the  development  of  formats  is  one  of  the  criti¬ 
cal  FSM  issues.  The  results  of  this  activity  should  then  be  used  to  modify 
and  update  the  Phase  II  FSM  implementation. 

The  updated  FSM  should  then  be  installed  in  a  full  mission  simulator  to  eval¬ 
uate  it  as  part  of  an  integrated  flight  deck.  A  comparison  should  be  made  be¬ 
tween  the  crew  performance  when  using  the  FSM  and  performance  when  using  con¬ 
ventional  alerting  components  (i.e.,  distributed  annunciators  and  status  infor¬ 
mation).  This  comparison  will  permit  the  validation  of  the  FSM  concept  and  an 
indication  of  the  ways  (if  any)  which  the  FSM  can  aid  the  crew. 

6.2  FSM/Aircraft  Interface 

In  order  for  the  flight  status  monitor  to  be  effective  it  must  be  able  to 
gather  and  process  large  amounts  of  information  about  the  aircraft.  Any  alert 
which  is  presented  to  the  crew  must  be  generated  from  this  data.  Any  guidance 
generated  by  the  FSM  in  response  to  a  non-normal  situation  must  have  its  basis 
in  the  data  stored  and  sensed  by  the  system.  Any  feedback  to  the  crew  as  a 
result  of  their  response  must  reflect  changes  in  the  sensed  data  and  the 
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ALERT  DISPLAY 

Prioritization 
Inhibition 
Multiple  alerts 
Predictive  Alerts 

PROCEDURES  DISPLAY 

Number  of  checklist  steps  displayed 
Coding  schemes  (color  and  monochrome) 

Display  format 

Operational  consideration  (menu,  paging,  etc.) 

Action  item  integration  (how,  where,  etc.) 

Control  technology  (line  select,  touch,  voice,  etc.) 

STATUS  DISPLAY 
Number  of  pages 

Information  presentation  (graphics  vs.  alphanumerics) 

Display  format  (plan  view,  side  view,  analog,  digital,  etc.) 

Amount  of  information  provided  per  page 

Operational  considerations  (automatic  page  select,  menu,  etc.) 

Controls  technology 

INTEGRATED  FSM  SYSTEM 
Display  of  intransit  actions 
Identify  holes  in  alerting  system  guidelines 
Integrating  the  time-critical  display  with  electronic  flight  instruments 
Expert  system  applications 


Table  6.1-1.  Unresolved  FSM  Issues 
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effect  that  those  changes  have  on  the  situation.  Therefore,  the  information 
flow  and  processing  will  comprise  a  large  part  of  the  FSM  system.  As  has  been 
discussed  in  previous  studies  (Ref.  4,5)  it  is  projected  that  for  future 
generation  aircraft  there  will  be  an  integration  of  flight  management,  flight 
control,  fault  monitoring,  maintenance  data  recording,  sensor  subsystem 
navigation  and  communication.  The  interchange  of  data  between  these  sources 
could  provide  a  pool  of  information  with  which  to  determine  overall  aircraft 
status.  The  major  study  area  relative  to  this  integration  is  to  define  the 
type  of  logic  required  to  process  the  data  and  to  provide  the  crew  with  the 
appropriate  information  to  perform  their  flight  task. 

Traditional  computing  which  requires  well  structured  problems  with  algorithmic 
solutions  based  on  full  information  with  a  single  correct  answer  may  not  be 
amenable  to  the  flight  status  monitor  operation.  What  may  be  required  for 
effective  operation  is  some  application  of  artificial  intelligence  which  can 
work  with  ill  structured  problems  which  require  a  search  for  a  solution  and 
can  use  incomplete  information  to  arrive  at  a  probablistic  answer.  The  term 
artificial  intelligence  is  used  to  designate  any  attempt  to  automate  or  eval¬ 
uate  human  type  reasoning.  Although  there  are  many  subfields  of  artificial 
intelligence,  the  one  most  applicable  to  the  FSM  is  the  field  of  expert  sys¬ 
tems.  This  system  would  use  a  specialized  knowledge  base  to  make  decisions, 
manipulating  that  knowledge  to  perform  at  a  level  comparable  to  a  human  expert 
for  a  specific  situation.  In  other  words,  the  system  will  have  a  knowledge 
base  that  has  been  gathered  from  experts  (pilots,  design  engineers,  safety 
inspectors,  etc.)  and  will  be  able  to  tap  and  relate  that  information  to  the 
flight  situation  in  a  timely  manner. 

Some  of  the  issue  that  need  to  be  resolved  about  expert  systems  should  include: 

1)  A  definition  of  the  scope  of  the  knowledge  base.  In  order  to  res¬ 
pond  to  the  wide  range  of  non-normal  situations  and  to  provide  the 
predictive  capabilities  and  flight  phase  adaptation,  a  comprehensive 
knowledge  base  is  required.  The  size  and  design  criteria  for  this 
data  base  should  be  investigated. 


79 


•imam 


V  A-'.  ' 


2)  Establish  the  expert  pool  for  buildinc}  the  knowledge  base.  The  FSM 
operation  will  be  tailored  to  each  individual  aircraft  and  there¬ 
fore,  it  will  be  necessary  to  identify  what  types  of  experts  should 
be  used  to  input  to  the  knowledge  base.  To  accomplish  this  objec¬ 
tive  it  will  also  be  necessary  to  develop  a  scheme  to  integrate  the 
data  from  a  number  of  different  experts  to  provide  a  single  meaning¬ 
ful  output. 

3)  Identify  the  alert  set.  It  may  not  be  possible  to  identify  and  ad¬ 
dress  every  combination  of  events  that  may  occur.  Therefore,  a  set 

of  criteria  should  be  developed  to  identify  alert  situations  for 
which  the  system  will  provide  crew  guidance. 

4)  Investigate  operational  and  design  considerations  with  respect  to 

their  impact  on  system  sensors  and  the  potential  FSM  operation. 
There  may  not  be  sensors  available  to  provide  some  of  the  data  that 
the  system  may  require  to  provide  the  crew  with  appropriate  informa¬ 
tion  about  some  specific  situations. 

5)  Define  the  prioritization  and  inhibition  schemes  and  how  they  will 

be  implemented.  There  are  situations  during  flight  operations  when 
some  information  should  be  inhibited  (e.g.,  the  large  number  of 

alerts  that  could  be  associated  with  an  engine  failure).  These  situ¬ 
ations  should  be  investigated  and  some  guidelines  developed.  Priori¬ 
tization  of  alerts  and  checklist  steps  will  require  a  set  of  rules 
for  implementation. 

6)  Determine  the  impact  of  arriving  at  probabilistic  answers  (a  feature 
of  expert  systems)  on  system  reliability  definitions.  Since  the  ex¬ 
pert  system  is  designed  to  be  able  to  arrive  at  an  answer  based  on 
partial  or  incomplete  information,  a  study  should  be  done  as  to  the 
effect  of  this  process  on  the  overall  system  reliability  figures  and 
how  that  impacts  the  certification  process. 

7.  Develop  a  plan  and  criteria  for  the  test  and  certification  of  expert 
systems. 


HO 
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A.O  FACILITIES 

One  of  the  most  important  aspects  of  any  applied  testing  program  is  the  selec¬ 
tion  and  development  of  the  test  facility  that  will  be  used  to  perform  the 
evaluation.  The  environment  created  by  the  facility  must  be  realistic  enough 
to  generate  data  which  satisfy  test  objectives.  In  the  present  study,  the 
technologies  being  evaluated  required  a  facility  capable  of  supporting  ad¬ 
vanced  controls  and  displays  and  providing  a  realiistic  environment  for  their 
evaluation.  The  following  sections  describe  the  test  facility  and  FSM  compo¬ 
nents  used  in  the  study  program. 

A.l  Flight  Deck  Research  Mockup  and  Integration  Laboratory 

The  Mockup  and  Integration  Laboratory  (Figure  A. 1-1)  is  a  basic  engineering 
laboratory  providing  R  ^  D  capability  that  facilitates  the  progressive  evolu¬ 
tion  of  new  display  and  control  concepts.  It  has  been  established  and,  in 
turn,  expanded:  to  provide  for  systematic  increases  in  both  simulation  and 
technological  capabilities;  and  to  provide  part-task  demonstration,  and  evalua¬ 
tion.  This  laboratory  provides  capabilities  to  support  (1)  early  laboratory 
work  requiring  use  of  bench  development  and  test  facilities,  (2)  successive 
stages  of  partial  simulation  using  simplified  approximations  of  sensor  and 
aircraft  systems,  and  (3)  concept  implementation  in  a  full-up  simulator  to 
confirm  appropriateness  of  interface  provisions  and  operations  prior  to  flight 
testing. 

The  laboratory  includes  an  all-electronic  cab  with  a  full  set  of  displays, 
representing  those  display  technologies  expected  to  be  available  and  matured 
by  1990.  The  cab  has  been  developed  to  fulfill  a  dual  purpose.  First,  the 
cab  provides  a  facility  to  appraise  the  requirements  for  an  individual  display 
.  or  control,  including  the  display  content,  i.e.,  what  information  is  needed. 

It  also  permits  preliminary  appraisal  of  dynamic  display  formats  to  ensure 
.  that  the  pilot  receives  the  information  easily  and  without  error.  Secondly, 

'  the  cab  provides  the  facility  to  initiate  systems  integration  which  is  neces¬ 

sary  in  the  development  of  new  displays  and  controls.  The  cab  can  facilitate 
an  appraisal  of  the  degree  with  which  a  new  display-control  concept  meets 
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flight  deck  systems  requirements.  Also,  the  cab  can  provide  the  facility  to 
conduct  the  architectural  integration  of  the  new  display-control  concept.  As 
a  system  integration  facility,  the  cab  has  become  a  concept  demonstrator  and 
the  foundation  for  the  development  of  an  all-electronic  cockpit  of  the  IbhO's. 

The  cab  is  supported  by  two  Smiths  Industries  programmable  symbol  generators. 
Each  can  drive  four  hybrid  stroke-raster  displays  -  two  primary  and  two  re¬ 
peaters.  These  were  specifically  designed  to  provide  flexibility  in  a  re¬ 
search  environment.  This  flexibility  includes  driving  different  types  of  dis¬ 
play  heads  (i.e.,  shadow  mask,  beam  penetration,  monochromatic  display  control 
(i.e.,  decrease  speeds,  refresh  rates,  line  densities)  and  driving  both  line 
and  arc  raster.  Software  support  includes  a  cross  assembler  and  cross  display 
compiler  hosted  on  an  HP3000  and  PDPH/23  respectively.  The  cross  compiler 
creates  a  data  set  that  is  interpreted  by  a  general  graphic  program  in  the 
Smiths.  The  method  used  provides  for  much  faster  display  build-up  and  change 
than  has  previously  been  done.  The  nature  of  the  cross  compiler  permits  dis¬ 
play  feature  specification  such  as  line,  arc,  text,  and  display  objects  in  a 
way  requiring  little  knowledge  of  programming.  Displays  can  now  be  put  to¬ 
gether  in  hours  instead  of  days. 

These  computers  provide  a  wide  variety  of  system  interfaces  (serial,  parallel, 
DMA,  etc.)  to  support  intersystem  communications.  Other  equipment  include  a 
Tektronix  microprocessor  development  system,  an  Applied  Science  Laboratories 
eye  view  monitor,  an  lEC  Voterm  voice  recognition  system,  a  Texas  Instruments 
voice  recognition  and  synthesis  system,  numerous  symbol  generators,  and  a  cus¬ 
tom  Collins  graphics  development  system  designed  to  work  with  7b7/7S7  symbol 
generators.  This  Collins  graphics  development  system,  hosted  on  a  VAX-ll/75n, 
is  the  forerunner  of  the  CTS-200n  system  proposed  for  use  in  the  NASA  Langley 
Experimental  Avionics  Systems  Integration  Laboratory  (EASILY). 

The  all-electronic  cab  has  the  display  features  shown  in  Figure  A. 1-2.  The 
modular  consoles  provide  the  flexibility  to  install  and  evaluate  alternative 
instrument  panel  design  concepts  in  both  static  and  limited  real-time  dynamic 
modes.  The  current  configuration  includes:  a  left-side  configuration  of  the 
767/757  Electronic  Flight  Instrument  System  (EFIS);  four  additional  color  CRT 
displays  to  present  airspeed,  altitude,  crew  alerting,  and  other  data  and  a 


Figure  A.  1-2.  All  Electronic  Flight  Deck 
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FSM  SYSTEM  DESCRIPTION 


Figure  A. 2. 0-1  shows  a  functional  diagram  of  the  FSM  system.  On  the  far  right 
of  the  figure  are  the  system-pilot  interfaces,  the  display-control  devices. 
On  the  bottom  the  airplane  host  simulator  function  components  are  shown.  Be¬ 
tween  the  FSM  pilot  interface  are  control  units  which  execute  the  commands  of 
the  controller  and  control  the  display  devices.  They  also  modulate  the  pilot 
control  actions  affecting  the  monitor.  Airplane  related  parameters  are  passed 
to  the  FSM  via  a  single  interface.  This  interface  also  acts  as  a  path  for 
data  back  to  the  the  airplane  simulation. 

The  FSM  system  consists  of  displays,  controls,  computers,  and  a  nockup  frame¬ 
work  to  provide  demonstration  and  concept  exploration  within  a  transport-like 
cab.  The  system  senses  non-normal  and  imminent  system  problems  and  then 
provides  guidance  to  the  crew  of  alternative  actions  to  handle  the  situation 
and  provide  different  optional  controls  to  effect  these  actions. 

The  system  can  be  divided  into  two  major  hardware  groups;  those  relating  di¬ 
rectly  to  sensing  airplane  abnormal  status  and  providing  information  and  sug¬ 
gested  action  to  the  crew;  and  those  related  to  airplane  simulation,  flight 
controls,  and  primary  displays. 

A. 2.1  Airplane  Simulation,  Control,  and  Flight  Displays 

The  airplane  simulation  is  for  a  large  transport  airplane  and  is  hosted  on  a 
Data  General  5260  minicomputer  with  magnetic  tape  recording  capability.  The 
magnetic  tape  is  the  primary  method  of  data  collection  for  the  FSM  system. 

Associated  with  the  airplane  simulation  is  a  simulation  console  for  initiating 
performance  related  failures  and  for  other  general  simulation  control  func¬ 
tions  Such  as  "go  to  initial  conditions"  (ICl,  simulation  hold,  and  simulation 
run.  These  same  simulation  control  functions  are  provided  in  the  cah  area  via 
an  experimental  control  panel . 
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holographic  headup  display  (HUD)  to  present  flight  path  information.  The  cen¬ 
ter  instrument  panel  features;  two  Engine  Indicating  and  Crew  Alerting  System 
(EICAS)  color  CRT  displays,  and  a  duplicate  pair  of  CRT's  located  below  them. 
The  right-side  is  currently  configured  to  accommodate  a  cross-section  of  alter¬ 
native  flat-panel  thin  film  electroluminescent  (TEEL)  displays. 
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Airplane  cab  primary  controls  inciurie  a  stick  controller  for  pitch,  roll,  and 
trim,  dual  throttles,  rudder  paddles,  flap  control,  and  wheel  retract. 

Airplane  primary  flight  displays  include  NAV  display  (horizontal),  the  primary 
flight  display,  and  the  engine  and  system  display.  The  displays  are  Collins 
video  shadow  mask  A-form  size  (4  3/4"  X  4  1/4“  high  display  area)  for  the  pri¬ 
mary  flight  display,  and  B-form  size  (4  3/4"  X  5  3/4"  high  display  area)  for 
the  NAV  display  and  engine  and  system  displays.  All  displays  are  hybrid 
stroke  and  raster  with  256  line  by  120  pixel  resolution. 


A. 2. 1.1  Display  System  Processor 


This  processor  obtains  reference  parameters  input  through  the  pilot  display 
controller  and  distributes  the  necessary  parameters  to  the  Nav  Graphics 
Generator  and  the  airplane  simulation.  It  also  performs  computations  on  data 
received  from  the  airplane  simulation  to  produce  results  which  are  transmitted 
to  the  NAG  Graphics  Generator  to  drive  the  Nav  Display  dynamically. 


The  processor  is  a  ROLM  1602  with  paralle,  5  RS232  serial,  a  11553A  serial, 
and  DMA  input,  output  interfaces.  It  contains  32K  bit  words  of  memory.  It 
also  contains  a  real-time  clock. 


A. 2. 2  FSM  Sensing  and  Displays 

The  FSM  display  and  control  system  is  independent  of  the  research  cab,  so  that 
it  may  operate  in  other  simulators.  Toward  this  end,  the  FSM  system  design  is 
autonomous  from  the  Boeing  simulator,  except  for  simulated-aircraft  system  sta¬ 
tus  data.  A  direct  result  of  this  design  philosophy  is  that  the  FSM  must  con¬ 
tain  all  the  functions  and  capabilities  for  handling  crew  alerting;  including 
alert  categor i zati on ,  prioritization,  and  inhibition  schemes;  algorithms  for 
handling  system  status  data;  checklist  and  procedural  schemes;  display  of  air¬ 
craft  status;  and  a  variety  of  system  control  paradigms. 

Central  to  the  FSM  system  is  a  computer  program  hosted  on  PDPll/23  computer, 
this  program  senses  system  status,  and  degrading  systems,  directs  display  func¬ 
tions,  prioritizes  alerts,  passes  procedure  and  status  data  to  the  displays. 
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and  directs  the  alert  data  to  the  alert  controler.  The  system  then  provides  a 
number  of  displays  to  provide  information  of  impending  or  current  problems  and 
provides  guidance  (procedures)  as  to  ways  of  preparing  for  the  problems  or 
actual  handling  of  the  problem  if  it  has  already  occurred. 

Connected  to  the  FSM  system  are  integrated  control  components  for  pilot  inter¬ 
action  to  effect  procedures.  Control  components  integrated  are  the  aircraft 
system  panels,  COU  multifunction  keyboard,  voice  control,  and  a  touch  panel  on 
the  status  display.  These  controls  are  collected  by  the  switch  monitor  compu¬ 
ter  and  transmitted  to  the  FSM  computer. 

Display  of  information  to  the  pilot  is  provided  by  the  alert  display,  master 
warning  and  caution  display,  critical  alert  display,  auditory  sound  and  voice 
messages,  airplane  and  system  status  display,  and  procedure  display  on  either 
a  color  video  display  or  the  multifunction  CDU  LED  display. 

Control  of  alerting  functions  are  primarily  the  master  warning  and  caution 
switch  and  the  line  select  and  alerting  function  activation  buttons  on  the 
alert  display.  The  voice  message  is  activated  by  a  button  on  the  control 
stick. 

The  PDPll/23  computer  contains  256K  memory.  It  has  four  (4)  parallel  input/ 
output  ports,  two  serial  ports  and  a  DMA  input/output  port. 

A. 2. 2.1  Alert  Display 

The  alert  display  is  on  the  left  in  Figure  A. 2. 2-1.  The  alert  display  or 
visual  alphanumeric  information  display  provides  one  location  for  warning 
caution  and  advisory  messages.  These  messages  provide  some  direction  as  to 
crew  corrective  actions  and  feedback  to  the  crew  when  the  faults  are  corrected. 

The  alert  display  is  an  A-form  size  color  display  shadow  mask  with  3"  x  3"  dis¬ 
play  area.  The  messages  are  color  coded  to  reflect  the  alert  level.  The  dis¬ 
play  provides  for  eleven  lines  of  messages,  16  characters  per  line.  Each  line 
has  associated  with  it  a  line  select  key  to  provide  for  an  alert  selection 
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function.  Alerting  control  functions  are  provided  by  six  keys  below  the  dis¬ 
play  (CHECKLIST,  STATUS,  STORE,  RECALL,  VOICE  and  PAGE). 

A. 2. 2. 2  Alert  Speaker 

An  alert  speaker  is  provided  for  alert  tones  and  aural  voice  messages.  The 

aural  voice  message  is  triggered  by  a  push  button  on  the  control  stick. 

A. 2. 2. 3  Master  Warning  and  Caution  Switch 

A  master  warning  and  caution  switch  is  mounted  in  front  of  the  pilot  on  the 
glare  shield  (Figure  A. 2. 2-1).  The  upper  half  of  the  switch  is  lighted  red 
for  warning  and  lower  half  in  lighted  amber  for  caution.  The  light  and  tones 
are  cancelled  by  depressing  the  switch. 

A. 2. 2. 4  Time-Critical  Display 

The  time-critical  display  is  used  to  provide  time-critical  alerts  with  recom¬ 
mended  action.  It  is  mounted  on  the  glareshield  to  the  right  of  the  master 
warning  and  caution  switch.  The  time-critical  display  is  a  Litton  Systems 

Canada  Limited  multicolor  LEO  display.  The  display  area  is  3  1/4"  X  2  1/4" 

with  a  resolution  of  32  pixels  per  inch.  Each  pixel  can  be  either  red,  green, 

or  amber  (combined  red  and  green)  and  can  be  intensity  controlled. 

A. 2. 2. 5  Procedure  Display 

The  procedure  display  is  either  a  color  shadow  mask  video  to  the  right  of  the 
alert  display  (Figure  A. 2. 2-1)  or  the  multifunction  COU  LEO  display  at  the 
upper  left  corner  of  the  center  stand.  Video  display  is  a  Collins  B-form  size 
color  video  display  (4  3/4"  X  5  3/4"  display  area).  The  Collins  hybrid  (both 
stroke  and  raster)  display  provides  for  color  coding  of  the  procedure  check¬ 
list  features.  The  Collins  resolution  is  256  line  by  120  pixel  resolution. 
The  video  is  driven  from  a  Smith's  Symbol  Generator  using  a  procedure  check¬ 
list  downloaded  from  the  FSM  computer.  The  control  display  unit  (COU)  dis¬ 
play,  a  Litton  Systems  Canada  Limited  multi  mode  matrix  green  monocromatic  LEO 
flat  panel  display.  The  LEO  display  area  is  4"  high  by  3"  wide  with  64  pixel/ 
inch  resolution. 
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A. 2. 2. 6  Status  Display 


The  status  display  is  located  below  the  procedure  display  (Figure  A. 2, 2-1). 
The  display  is  used  to  provide  airplane  status,  procedure  checklist  subsystem 
diagrams,  failed  system  diagrams,  and  failed  system  information.  The  touch 
panel  provides  a  means  for  interacting  with  the  display  to  effect  system  con¬ 
trol  functions.  The  touch  panel  surface  provides  for  touch  discrimination  of 
up  to  ten  across  and  twelve  down.  The  display  is  a  Collins  B-form  size  (4  3/4" 
X  5  3/4"  high  display  area)  color  video  display  with  a  touch  panel  clear  plas¬ 
tic  sheet  over  the  surface  of  the  display.  The  display  is  a  256-line  by  12(1- 
pixel  resolution  hybrid  (both  stroke  and  raster)  display. 

A. 2. 2. 7  Multifunction  Keyboard 

The  multifunction  keyboard  is  part  of  the  CDU  which  is  mounted  before  the  CDU 
scratch  pad  in  the  upper  left  corner  of  the  center  stand.  These  switches  are 
used  for  working  procedure  checklists  indicating  to  the  FSM  the  pilot  desired 
action  for  each  checklist  item.  The  keyboard  is  a  matrix  of  switches  (three 
across  by  five  down)  developed  by  Honeywell  Micro  Switch  Division.  The 
switches  are  solid-state  Hall  effect  momentary  action  with  tactile  feedback. 
Each  switch  face  is  a  0.4"  high  by  0.875"  wide  sunlight  readable  green  LED  dis¬ 
play  with  40  pixel /inch  resolution.  The  switch  changes  its  function  dynami¬ 
cally.  Two  character  sizes,  5x7  pixel  and  10  x  14  pixel,  provide  for  feed¬ 
back  to  the  pilot  of  the  switch's  current  function. 

A. 2. 2. 8  Voice  Control 

Voice  control  is  provided  vi  a  a  Texas  Instruments  TM320  Microprocessor  Speech 
Synthesis  and  Recognition  System.  The  system  recognizes  a  connected  stream  of 
words  for  activating  alerting  functions  and  as  system  controls  through  the  pro¬ 
cedure  checklists.  Depressing  a  button  on  the  control  stick  opens  the  recogni¬ 
tion  system  for  listening  and  the  bottom  line  on  the  CDU  display  provides  for 
feedback  on  what  the  recognition  system  understood.  Activation  is  followed  by 
a  verbal  "GO". 


This  system  combines  the  two  basic  components  of  speech  technology,  speech  syn¬ 
thesis  and  recognition,  into  a  single  unit.  The  speech  synthesis  is  based  on 
the  TM  320  microprocessor  and  uses  a  linear  predictive  coding  algorithm  to 
model  the  human  voice.  It  uses  a  data  rate  of  2400  bits  per  second  of  speech 
and  a  high  density  information  compression  to  store  16  minutes  of  speech  on  an 
8- inch  floppy  disk. 

The  voice  recognition  component  is  speaker  dependent  (i.e.,  must  be  trained 
for  each  user.  It  recognizes  connected  streams  of  words  allowing  the  pilot  to 
use  normal  sentences  to  issue  commands.  Computer  recognition  accuracy  of  con¬ 
nected  word  phrases  is  typically  greater  than  99%  with  the  proper  training 
regime. 

A. 2. 2. 9  Touch  Panel 

A  touch  interactive  display  panel  was  used  as  the  control  device  for  the 
"touch  panel"  concept. 

The  touch  panel  is  a  thin  plastic  sheet  across  the  face  of  the  status  display 
(4.5"  X  5.5").  The  panel  is  able  to  discriminate  12  rows  vertical  by  10 
columns  horizontal.  An  electronic  scanner  polls  the  sheet  20  times  a  second 
to  touch  depression  and  transmits  the  depression  to  the  switch  monitor. 

A. 2. 10  Alert  Controller 

The  Alert  Controller  was  built  by  Boeing  to  act  as  a  general  purpose  aircraft 
simulator  alert  controller  and  driver.  It  uses  two  Z80  microprocessors  to  con¬ 
trol  alert  events,  monitor  switch  actions,  generate  alert  tones  and  voice  mes¬ 
sages  and  output  data  to  other  systems  such  as  the  alert  display  and  the  time 
critical  alert  display. 

The  voice  alerts  were  generated  by  a  Boeing  refined  voice  encoder /decoder 
board.  This  voice  system  uses  2000  bytes  of  memory  per  second  of  speech  and 
produces  a  high  quality  reproduction  of  voice  patterns  it  records.  Two  voice 
message  data  bases  were  stored  on  EPROM. 


1.0  INTRODUCTION 


Over  the  past  11  years,  the  Federal  Aviation  Administration  has  sponsored  the 
investigation  and  development  of  systems  to  alert  and  inform  the  crew  about 
non-normal  aircraft  situations.  The  scope  of  the  successive  programs  has  in¬ 
creased  so  that  system  complexity  has  progressed  from  a  consideration  of  a 
single  alert  situation,  the  independant  altitude  monitor  or  ground  proximity 
alert,  to  a  consideration  of  the  total  aircraft  status.  The  results  of  this 
progression  is  that  a  highly  self-contained  and  complex  system  has  been  identi¬ 
fied  that  will  facilitate  crew  responses  to  alerting  situations.  This  system 
is  known  as  the  Flight  Status  Monitor  (FSM),  and  its  functions  include:  inform¬ 
ing  the  crew  that  a  non-normal  situation  has  (or  possibly  will  in  the  near 
future)  occurred;  identifying  the  problem  to  the  crew;  indicating  the  urgency 
of  the  situation;  providing  the  crew  with  guidance  for  responding  to  the  pro¬ 
blem;  and  providing  feedback  to  the  crew  concerning  the  adequacy  of  their 
response. 

This  manual  is  to  be  used  as  part  of  the  training  and  familiarization  program 
for  pilots  participating  in  the  Phase  II  FSM  testing.  It  provides  the  crews, 
and  any  observers,  the  background  information  necessary  to  understand  and  use 
the  candidate  FSM  di spl ay /control  concepts.  The  document  is  divided  into  four 
major  sections.  The  first  section  provides  an  introduction  and  some  back¬ 
ground  for  the  FSM.  The  second  section  describes  the  alerting  components  of 
the  FSM  which  include:  the  master  alerts,  both  aural  and  visual;  the  visual 
information  or  alert  display;  and  the  voice  alert  display.  The  third  section 
describes  the  guidance  and  feedback  components.  There  are  five  candidate  dis¬ 
play/control  concepts  for  these  components,  and  the  operating  procedures  for 
each  will  be  covered.  The  last  section  will  describe  the  evaluation  in  which 
you  will  be  participating. 

The  FSM  is  a  system  which  not  only  consolidates  and  standardizes  the  crew 
alerting  function,  but  also  has  the  capability  of  monitoring  the  array  of  air¬ 
craft  sensors,  combining  and  interpreting  the  information,  and  providing  the 
crew  with  guidance  in  responding  to  non-normal  situations,  and  feedback  about 
the  adequacy  of  their  response  and  an  indication  of  the  status  of  their  air¬ 
craft.  The  logic  within  the  system  provides  capabilities  such  as:  adapting  to 


changing  flight  phases;  prioritizing  alerts;  integrating  procedures;  transl at- 
ing  operational  and  mechanical  abnormal  conditions  into  aircraft  status  infor¬ 
mation;  and  applying  historical  data  to  provide  predictive  information. 

The  system  provides  the  crew  with  a  number  of  different  types  of  information. 
The  alerting  components  of  the  system  attract  the  crew's  attention  to  the  non¬ 
normal  situation,  identify  the  specific  problem  or  problems,  and  indicate  of 
the  urgency  of  the  situation.  The  guidance  component  of  the  system  contains 
the  information  that  the  crew  requires  to  respond  to  the  situation.  The  ac¬ 
tion  steps  for  situations  resulting  from  simultaneous  problems  will  be  inte¬ 
grated  to  provide  the  crew  with  a  systematic  response  or  action  flow.  This 
component  also  provides  an  indication  as  the  crew  completes  each  action  item 
in  the  procedure.  Finally,  the  feedback  component  supplies  aircraft-level  and 
system-level  status  information.  The  system  is  also  capable  of  supplying  the 
supplemental  information  that  would  normally  be  found  in  the  Operations  Manual. 


2.0  ALERTING  COMPONENTS 


The  crew  will  be  alerted  to  problems  in  three  urgency  categories:  warning, 
caution  and  advisory.  For  the  FSM  these  categories  are  defined  as  follows: 

Warning  -  Any  non-normal  operational  or  aircraft  system  conditions  that 
require  immediate  corrective  or  compensatory  crew  action. 

Caution  -  Any  non-normal  operational  or  aircraft  system  conditions  that 
require  immediate  crew  awareness  and  prompt  corrective  or 
compensatory  crew  action. 

Advisory  -  Non-normal  operational  or  aircraft  system  conditions  that 
require  crew  awareness  and  may  require  crew  action. 

There  are  several  alerting  components  included  in  the  FSM  system.  The  master 
visual  alert  will  be  used  to  get  your  attention  (visually)  for  warnings  (red) 
and  cautions  (amber).  It  is  located  on  the  glareshield  above  the  primary 
flight  instruments.  Associated  with  the  master/visual  display  is  a  master 
aural  alert  which  consists  of  a  different  sound  for  each  urgency  level:  Euro¬ 
pean  siren  for  warnings;  steady  sound  for  caution,  and  a  chime  for  advisories. 
Both  the  visual  and  aural  master  alerts  can  be  cancelled  by  depressing  the 

master  warning/caution  switch. 

Simultaneously  with  the  master  alert  you  will  get  an  alphanumeric  message, 
i.e.,  "L  ENG  ANTI-ICE",  on  your  alert  display  (Figure  1).  This  message  will 
identify  the  problem  and  be  color  coded  to  indicate  urge  icy.  Figure  ?  pro¬ 
vides  a  close-up  of  the  alert  display.  The  display  has  active  lines  for  ele¬ 
ven  alert  messages,  one  per  line.  If  there  are  more  than  eleven  alerts  or  if 

any  alerts  have  been  stored  into  the  system  memory,  the  bottom  line  of  the 

display  will  be  used  to  indicate  the  number  of  alerts  stored  (e.g.,  M4)  or  the 
number  of  pages  of  alerts  (e.g.,  1/2,  212).  Alerts  will  be  grouped  on  the 

display  according  to  their  urgency-level  with  warnings  higher  than  cautions 
which  are  in  turn  above  advisories.  The  line  select  keys  located  on  both 
sides  of  the  display  permit  you  to  indicate  specific  alert(s)  to  the  system 
and  subsequently  take  some  action  on  that  specific  alert.  These  keys  corres- 
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pond  to  the  lines  of  the  display  with  the  top  key  on  the  left  indicating  line 
one  and  the  top  key  on  the  right  line  two.  The  second  key  on  the  left  is  for 
line  3  and  the  second  on  the  right  for  line  4,  etc..  The  control  keys  below 
the  displays  actuate  the  following  system  functions: 

CKLST  -  Controls  the  paging  function  of  the  checklist,  multiple 

pushes  of  the  key  will  result  in  paging  the  procedures  dis¬ 
play  for  checklists  which  are  too  long  for  one  page. 

STORE  -  Stores  alert  messages  into  the  system  memory.  Messages  may 

be  stored  individually  by  using  the  line  select  function  and 
the  "STORE"  key,  or  all  storable  alerts  can  be  put  in  memory 
by  using  the  "STORE"  key  without  selecting  any  alert;  only 
alerts  which  have  no  incompleted  checklist  items  may  be  stor¬ 
ed  and  warning  messages  cannot  be  stored. 

RECAL  -  Recalls  all  the  alert  messages  from  memory  and  displays  them 

on  the  screen  with  the  cautions  below  any  warnings  and  the 
advisories  below  the  cautions;  the  messages  will  also  be  chro¬ 
nological  within  urgency  level  with  the  most  recent  alert  on 
top. 

PAGE  -  This  key  controls  only  the  alert  display;  when  there  are  more 
alerts  than  can  be  accommodated  on  the  display  the  "PAGE"  key 
advances  the  display  through  the  available  alerts  a  page  at  a 
time. 

VOICE  -  One  of  the  concepts  being  evaluated  is  controling  system 
action  by  voice.  The  "VOICE"  key  will  be  used  to  activate 
the  voice  control  components  during  that  evaluation  only. 

STAT  -  Calls  up  and  activates  the  status  display.  The  first  push  of 
the  "STATUS"  key  will  result  in  aircraft-level  status  being 
displayed.  If  there  is  (are)  an  alertfsl  selected,  the  second 
key  push  will  result  in  the  presentation  of  the  series  of  sys¬ 
tems  being  reconfigured  during  the  response  to  the  alert,  the 
third  (and  subsequent)  acti vationfs )  will  provide  the  system 


status  of  the  faulted  system(s).  After  displaying  all  the 
faulted  systems  another  key  push  will  result  in  calling  up 
any  supplemental  information  available  about  the  alert. 

The  final  alerting  component  is  the  voice  display.  For  warning-level  alerts 
that  are  time-critical  (e.g.,  ground  prox),  the  voice  alert  will  be  presented 
automatically.  To  cancel  the  automatic  voice  presentation  you  depress  the 
master  warning/caution  switch;  the  visual  time-critical  message  will  remain. 
Other  warnings  and  cautions  will  have  the  voice  alert  available  to  you  by  de¬ 
pressing  the  thumb  switch  on  the  control  stick.  The  voice  alerts  will  be  iden¬ 
tical  to  the  message  presented  on  the  alert  display.  The  optional  warning  and 
caution  voice  messages  will  be  presented  only  once  with  each  thumb  switch 
depression. 


3.0  GUIDANCE  AND  FEEDBACK  COMPONENTS 


"  »  *  »  -  .  ’ 


The  candidate  FSM  di spl ay/control  concepts  differ  only  in  the  guidance  and 
feedback  components.  The  concepts  differ  in  their  level  of  automation:  man¬ 
ual,  system  aided  and  automatic.  With  the  manual  method,  aircraft  system  re¬ 
configuration  is  accomplished  on  the  systems  overhead  panel.  The  system  aided 
concepts  have  automatic  display  callup,  and  the  aircraft  systems  are  control¬ 
led  by  innovative  concepts  in  conjunction  with  the  FSM  displays  including 
voice  interaction,  touch  panel  overlays,  and  a  multifunction  keyboard.  The 
last  concept  is  automatic  reconfiguration  which  only  requires  the  crew  to  give 
a  go-ahead  signal.  This  concept  may  be  used  in  conjunction  with  any  of  the 
above  concepts,  but  for  this  study  it  was  implemented  only  in  the  multifunc¬ 
tion  keyboard  concept.  In  all  of  the  concepts,  feedback  information  is  provid¬ 
ed  on  both  the  procedures  and  status  displays. 

The  major  FSM  display  components  used  to  provide  the  guidance  and  feedback 
function  are  the  procedures  display  and  the  status  display.  The  crew  will 
interact  with  both  of  these  displays  while  responding  to  the  alert  situations. 

Procedures  Display 

Step-by-step  procedures  for  responding  to  normal  and  non-normal  situations  are 
presented  on  the  procedures  display  in  checklist  format  (Figure  3).  One 
action  item  is  presented  per  line  whenever  feasible,  and  as  many  action  items 
as  feasible  are  presented  on  a  single  page.  The  items  requiring  crew  action 
are  one  color,  and  the  completed  actions  are  another  color.  As  the  crew  com¬ 
pletes  an  action,  the  action  item  changes  color.  If  the  action  is  not  sensed 
by  the  aircraft,  the  crew  must  acknowledge  its  completion,  by  selecting  a 
"DONE"  key,  before  the  item  changes  color  (Figure  4).  If  the  crew  fails  to 
perform  an  action  item  and  proceeds  to  the  next  action  item,  the  uncompleted 
item  will  remain  in  the  action  color. 


The  actions  will  be  listed  in  priority  order.  All  actions  that  have  an  immed¬ 
iate  effect  on  aircraft  safety  will  be  listed  first.  Lesser  procedures  and 
procedures  affecting  other  flight  phases  will  follow.  The  latter  will  automati¬ 
cally  be  integrated  into  checklists  in  those  flight  phases.  For  multiple 
alerts,  the  actions  will  be  integrated  according  to  the  priority  logic  estab¬ 
lished  by  the  system. 
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Figure  3.  Leading  Edge  Slats  Asymmetry  Alert  Procedures 
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The  status  display  will  have  pictorial  and  alphanumeric  presentations.  There 
may  be  as  many  as  four  presentations  associated  with  a  fault: 

1.  A  page  presenting  the  aircraft  status;  degraded  flight  control  sys¬ 
tems,  operational  limits  and  the  non-operating  systems  (Figure  5). 

2.  A  page(s)  showing  a  schematic  diagram  of  the  system(s)  involved  with 
the  procedural  action(s)  (Figure  6). 

3.  A  page(s)  identifying  a  system  with  the  primary  failure  (Figure  6). 

4.  A  page(s)  presenting  any  additional,  operational  information  that  is 
currently  contained  in  operations  and  flight  manuals  (Figure  7). 

The  first  status  page  will  show  aircraft  status,  including  degraded  flight 
control  systems  and  operating  limits.  The  second  page  (or  set  of  pages)  will 
display  a  diagram  of  the  procedural  action  site(s).  The  third  page  will  show 
a  diagram  of  the  system  or  subsystem  containing  the  failure  which  generated 
the  alert.  The  fourth  page  (or  set  of  pages)  will  display  information  perti¬ 
nent  to  the  flight  operations  as  a  result  of  the  failure/  alerting  situation. 

System  status  will  be  shown  by  simplified  system  schematics.  These  schematics 
will  show  the  system  by  interconnecting  lines  and  identify  different  compo¬ 
nents  by  symbol  shapes.  Color  coding  will  be  used  to  indicate  operating  and 
fault  status.  For  example,  white  symbols  could  indicate  "OFF"  status  and  a 
green  symbol  could  indicate  "ON"  status.  Alphanumerics  will  be  used  to  iden¬ 
tify  the  components  and  for  presenting  quantitative  parameter  values  when 
required. 

Aircraft  status  will  be  shown  by  a  simplified  pictorial  of  an  aircraft  (e.g., 
a  plan  view  outline  of  the  aircraft).  Symbols  will  be  used  as  much  as  possi¬ 
ble  for  the  faulted  flight  control  systems.  Other  information  will  be  pre¬ 
sented  by  alphanumerics.  Failed  components  will  be  color  coded  according  to 
fault  level  (e.g.,  red  or  amber). 
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Figure  7.  Engine  Anti-Ice  Operational  Information 


System  Control 

Several  alternatives  have  been  selected  for  control  of  the  aircraft  systems 
(e.g.,  hydraulics,  electrical,  PCS,  fuel,  etc.)  in  conjunction  with  the  FSM. 
These  include: 

1*  System  Control  Panels  -  System  control  panels  are  located  in  the  over¬ 
head  panel.  The  aircraft  systems  are  controlled  with  the  systems 
panel  which  is  not  part  of  the  FSM.  However,  information  feedback  on 
the  status  of  the  controls  and  the  operation  of  the  system  is  provid¬ 
ed  by  the  FSM. 

2.  Touch  Panel  Control  -  The  touch  panel  overlaying  the  status  display 
allows  system  control  to  be  next  to  the  displayed  procedures.  The 
touch  panel  allows  the  crew  to  perform  the  action  item  by  touching 
the  display.  Feedback  information  is  presented  on  both  the  proce¬ 
dures  and  status  displays,  and  the  crew's  attention  is  focused  on 
only  these  two  displays  for  completing  the  procedure. 

3.  Voice  Interactive  Control  -  Voice  commands  are  used  to  call  up  and 
control  the  di spl ays  and  the  aircraft  systems.  The  voice  system  is 
activated  by  depressing  the  FSM  VOICE  key.  After  activation,  the 
crew  is  able  to  call  up  and  perform  the  action  items. 

4.  Multifunction  Keyboard  -  The  multifunction  keyboard  is  configured 
with  programmable  legend  keys.  The  first  key  lists  the  first  action 
item  from  the  procedures  display.  The  second  action  item  is  listed 
on  the  second  multifunction  key,  and  so  on.  To  perform  the  action 
item  all  the  pilot  has  to  do  is  depress  the  corresponding  multifunc¬ 
tion  key  (Figure  8). 

The  following  paragraphs  will  describe  each  of  the  concepts  and  its  associated 
functions  and  operation. 

Basic  Concept 


The  operation  of  the  Basic  concept  is  shown  in  Figure  9.  After  an  alert 
occurs,  the  crew  cancels  the  master  caution  and  warning  indicator  and  reads 
the  alert  display  to  identify  the  fault.  By  pushing  the  line  select  key,  the 
alert  procedure  is  displayed  on  the  procedures  display  and  the  aircraft  status 
is  presented  on  the  status  display.  By  repeated  pushing  of  the  CHECKLIST  key, 
the  crew  may  step  through  the  procedure  pages.  By  selecting  the  STATUS  key, 
the  FSM  will  display  the  system  schematic  associated  with  the  first  procedural 
action  item. 


The  crew  reads  the  checklist  and  performs  the  necessary  actions  on  the  over¬ 
head  panel.  If  there  is  more  than  one  page  of  procedures,  the  completion  of 
the  items  on  the  first  page  will  bring  up  the  next  page.  After  the  procedures 
are  completed,  the  crew  may  step  through  the  status  pages  by  pushing  the 
STATUS  key.  After  completion  of  the  checklist  procedures,  the  displays  will 
be  cleared.  The  alert  message  is  removed  from  the  alert  display  if  the  alert¬ 
ing  situation  no  longer  exists;  otherwise,  it  may  be  cleared  by  line  selecting 
the  alert  and  selecting  STORE.  Selecting  STORE  without  a  line  selected  will 
store  all  alerts,  except  warning  level  alerts  and  alerts  which  have  pending 
checkl i sts . 

Touch  Panel  Interactive  Concept 

This  concept  is  illustrated  in  Figure  10.  The  procedures  display  and  status 
display  (aircraft  status  page)  are  automatically  called  up  by  the  pilot  select¬ 
ing  the  line  address  key  on  the  alert  display.  The  pilot  performs  the  actions 
directly  on  the  status  display.  After  manually  stepping  past  the  aircraft 
status  page,  the  status  display  will  contain  a  schematic,  related  to  the  first 
action-item,  with  computer  generated  touch  keys  to  reconfigure  the  system. 
Feedback  information  is  presented  on  both  the  procedures  and  status  displays. 
Each  action  item  will  have  a  corresponding  schematic  diagram  on  the  status 
display.  This  display  is  also  touch  interactive  for  calling  up  more  detailed 
information . 

Voice  Interactive  Concept 

This  concept,  shown  in  Figure  11  uses  voice  for  both  messages  and  control  of 
the  displays  and  aircraft  systems.  Voice  control  activation  is  optional,  and 
both  the  displays  and  systems  may  be  manually  controlled  as  described  under 
the  Basic  or  Touch  Interactive  concepts.  Voice  messages  are  used  to  direct 
the  crew's  attention  to  alerts  and  to  the  actions  to  be  performed  if  the  alert 
is  a  time-critical  alert. 

After  pushing  the  line  select  key,  the  pilot  may  select  voice  interaction  by 
depressing  the  VOICE  key.  When  the  displays  are  called  up,  the  first  action 
item  would  be  addressed.  To  execute  an  action  item,  the  crew  says,  for  exam¬ 
ple,  "PUMP  1  OFF",  the  system  will  display  what  has  been  said  on  the  single- 
line  display  directly  in  front  of  the  pilot  (below  the  EHSl).  If  the  display 
is  correct,  the  pilot  gives  an  execution  command,  "GO"  and  the  system  will 
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complete  the  action.  The  crew  continues  this  process  until  all  the  procedures 
are  completed.  Feedback  is  presented  visually  on  the  procedures  and  status 
displays  and  may  be  presented  by  voice  messages. 


Multifunction  Keyboard  Concept 

This  concept  uses  a  multifunction  keyboard  with  programmable  keys  and  a 
scratchpad  representing  an  implementation  in  an  aircraft  that  did  not  have 
display  space  for  both  the  procedure  and  status  displays,  but  did  have  a  multi¬ 
function  CDU.  The  scratchpad  display  presents  the  alert  procedures.  Aircraft 
status,  system  diagrams,  and  operational  information  are  presented  on  the  sta¬ 
tus  display  as  in  the  other  concepts.  The  multifunction  keyboard  provides  the 
means  to  perform  the  control  action  by  using  the  keys  marked:  "Go"  to  execute 
the  active  system  item  on  the  checklist  (e.g.,  no  smoking  sign  on);  "Done"  to 
indicate  the  completion  of  a  pilot  action  (e.g.,  fuel  balance  check);  and 
"Skip"  to  skip  over  an  action  item  on  the  checklist. 

The  operation,  as  illustrated  in  Figure  12,  shows  that  after  line  selecting 
the  alert,  the  checklist  appears  on  the  scratchpad,  and  the  actions  are  pre¬ 
sented  in  sequence.  To  perform  the  action  items,  the  pilot  must  depress  the 
appropriate  multifunction  key.  This  procedure  is  continued  until  all  items 
are  completed.  Feedback  is  provided  on  the  scratchpad,  and  on  the  status  dis¬ 
play.  The  operation  of  the  checklist  on  the  scratchpad  is  the  same  as  on  the 
procedures  display  used  in  the  other  concepts. 

Automatic  Reconfiguration  Concept 

Any  of  the  systems-aided  concepts  could  incorporate  pilot-initiated  automatic 
system  reconfiguration.  For  demonstration  purposes,  the  multifunction  key¬ 
board  concept  was  used  to  evaluate  the  feasibility  of  this  control  method. 
This  concept  requires  the  same  steps  to  call  up  the  checklist  on  the  scratch¬ 
pad  display  and  the  procedural  steps  on  the  keyboard.  However,  the  crew  has 
only  to  select  one  key,  a  dedicated  key  labeled  EXECute,  to  initiate  the  cor¬ 
rective  action.  The  system  automatically  does  the  action  items  that  are  inter¬ 
active  with  the  aircraft  systems,  at  a  predetermined  rate,  stopping  at  items 
that  must  be  accomplished  by  the  pilot.  Action  and  status  feedback  are  pre¬ 
sented  on  the  status  and  scratchpad  displays  (Figure  13).  The  crew  has  the 
option  to  stop  the  reconfiguration  at  any  time. 


•  Alert 

•  Cancel  master  alerts  — ► 
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Alert  display 


Multifunction  keyboard 


•  Read  checklist 

•  Do  checklist 


Status  display 


Figure  12.  The  Multifunction  Keyboard  Concept 


•  Read  checklist 

•  Select  EXECute 


•  Alert 

•  Cancel  alerts 

•  Line  select 


1 


System  reconfiguration 
Observe  feedback 
Observe  status 


4.0  TEST  PROCEDURE 


The  test  period  for  each  two-man  crew  will  be  approximately  four  hours.  Upon 
arriving  at  the  test  location,  you  will  be  given  a  brief  introduction  to  the 

simulator.  The  aircraft  model  you  will  fly  is  not  intended  to  represent  any 

plane  with  which  you  are  familiar.  It  is  a  model  of  a  wide  bodied  airplane 
with  two  engines  and  is  being  used  solely  to  provide  a  flight  task  and  should 
not  be  evaluated  with  respect  to  actual  flight  characteristics. 

After  the  introduction,  the  pilots  will  be  positioned  at  eye  reference  point 

in  the  simulator  and  permitted  to  fly  the  simulator  for  familiarization.  A 

calibration  of  the  eye  view  monitor  will  be  performed  so  that  eye  tracking 
data  can  be  obtained  during  all  flights.  Training  for  the  first  FSM  concept 
will  then  be  conducted  for  approximately  15  minutes.  The  training  will  empha¬ 
size  the  input  procedures,  system  controls  and  display  formats  that  will  be 
utilized  in  performing  the  test  tasks.  An  instructor  pilot  will  be  present  to 
provide  guidance  throughout  the  training  sessions.  After  the  training  ses¬ 
sion,  the  test  trials  will  begin. 

Each  of  the  three  test  trials  will  be  performed  by  crews  of  two  pilots.  The 
pilot  in  the  left  seat  will  operate  the  FSM  while  flying  the  aircraft.  The 

pilot  in  the  right  seat  will  observe  the  FSM  operation  and  evaluate  the  work¬ 

load  imposed  by  the  system. 

At  the  beginning  of  each  test  trial,  you  will  be  informed  where  you  are  in  the 

flight  (flight  phase).  In  general,  you  will  be  instructed  to  respond  to  each 

alert  as  you  would  in  an  actual  flight  operations  and  to  apply  your  best 
efforts  not  only  in  performing  the  response-task ,  but  also  in  maintaining  your 
flight  performance. 

At  the  completion  of  the  test  trials  for  each  FSM  concept,  a  debriefing  ques¬ 
tionnaire  will  be  administered  to  elicit  a  subjective  evaluation  of  the  FSM 
operation  and  format  and  also  so  you  can  evaluate  the  amount  of  work  required 
to  use  the  control  and  displays.  The  test  conductor  and  instructor  pilot  will 
be  present  during  the  debriefing  to  answer  questions  and  ensure  that  the  ques¬ 
tionnaire  is  properly  completed.  At  the  completion  of  all  test  trials,  you 
will  be  given  another  questionnaire  which  will  permit  you  to  make  comparisons 
among  all  five  FSM  concepts  and  to  provide  suggestions  for  improvements.  The 


test  conductor  will  also  perform  and  record  an  information  interview  in  order 
to  permit  you  to  expand  your  opinion  on  any  area  you  wish.  Each  pilot  will 
also  be  asked  to  complete  a  standard  questionnaire  concerning  prior  flight 
experience. 


^  r 


Date 


FSM  Concept  Flown 


Scenario 


Please  complete  the  following  questionnaire  with  respect  to  the  alerts  which 
occurred  during  your  last  flight.  Use  the  "comments"  space  freely  since  your 
input  is  important  in  developing  a  viable  system.  Also,  use  the  "comment" 
space  to  enumerate  any  operational  difficulties  encountered  during  the  flight. 

I.  ALERTS  AND  PROCEDURES 

1.  Were  all  the  alerts  and  expected  pilot  actions  (procedure)  clear 
and  unambiguous? 

Yes  No 


If  not,  describe  the  alerts  and  the  associated  problem. 


Using  your  current  procedure  as  a  reference,  answer  the  following  questions 
and  compare  the  FSM  concept  which  you  have  just  flown  to  that  reference. 

1.  Compared  to  your  current  alerting  system,  the  attention-getting 
quality  of  the  system  you  just  flew  was  - 


Much  better 
Moderately  better 
Slightly  better 
The  same 
Slightly  worse 
Moderately  worse 
Much  worse 


Comments 


Compared  to  your  current  alerting  system,  the  mental  effort  to 
understand  what  is  wrong  and  what  to  do  about  it  with  the  test 
system  you  just  flew  was  - 

_  Much  less 

_  Moderately  less 

_  SI i ghtly  1  ess 

_  The  same 

_  SI i ght  more 

_  Moderately  more 

Much  more 


Comments 


Compared  to  your  current  response  to  alerting  situations,  the  re¬ 
quired  responses  with  the  test  system  you  just  flew  were  - 

_  Much  easier 

_  Moderately  easier 

_ Slightly  easier 

_  The  same 

_  Slightly  harder 

_  Moderately  harder 

Much  harder 


Comments 


Compared  to  your  present  response  to  alerting  situations,  the  com¬ 
plexity  of  the  responses  with  the  test  system  you  just  flew  were  - 


Much  lower 
Moderately  lower 
Slight  lower 
The  same 
Slight  higher 
Moderately  higher 
Much  higher 


Comments 


Compared  to  your  current  operations,  the  ability  to  maintain  othe 
piloting  functions  while  responding  to  alerts  with  the  test  syste 
you  just  flew  was  - 

_  Much  easier 

_  Moderately  easier 

_  Slightly  easier 

_  The  same 

_  Slightly  harder 

_  Moderately  harder 

Much  harder 


Comments 


-j.  JI-JJ  f  JJtf.TFTJA^  W  AWVJVJWd  V.  '^.  m<  Tj  ^MiJ>  HJI  U  JWIl"  ^  IWDl  LV^m  tn 


6.  Compared  to  your  current  system,  the  overall  workload  you  exper¬ 
ienced  operating  the  test  system  was: 

_  Much  lower 

_  Moderately  lower 

The  same 


S- 


Moderately  higher 
Much  higher 


i. 


Comments 
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Compared  to  your  current  system,  the  probability  of  making  an 
with  the  test  system  was: 

_  Much  less 

_  Moderately  less 

_  The  Same 

_  Moderately  more 

Much  more 


err 


Comments 


APPENDIX  D 


FLIGHT  STATUS  MONITOR 
PROGRAM  DEBRIEFING  QUESTIONNAIRE 


PILOT  QUESTIONNAIRE  AND  INSTRUCTIONS 


Pilot  Questionnaire 

Leave  Blank 
Subj.  assigned  code 


Exp.  No.: 
BOT: 

EOT: 

Vis.  Test's': 
Form  Compl . 

naires. 

(Please  Print  all  answers) 

Name: 


Note:  This  study  is  designed  to  assess  the 

advantages  and  disadvantages  of  the 
Flight  Status  Monitor  concept  for 
possible  use  in  commercial  aviation. 
All  information  you  give  on  this 
form  will  be  kept  confidential  and 
will  be  summarized  statistically 
with  the  data  from  other  question- 


Address: _ _ 

Phone  (office  pref.)  (  ) _ 8irtbdate:_ 

Do  you  wear  glasses/contacts  while  flying?  yes  no 
If  you  have  no  military  experience  skip  question  la. 


(circle) 


Military  Background:  Branch _ 

Did  you  receive  military  pilot  training?  yes  no  (circle) 
List  aircraft  types  in  which  you  were  qualified  (if  applicable 
otherwise  leave  blank) 


List  all  aviation-related  (specialized)  training 


(continue  on  opposite  side  if  necessary) 


Total  hours  flown  (approx.)  2b.  Years  flying  since  solo: _ 

not  including  Flight  Engr:  _ 

Have  you  had  any  RSD  experience  as  a  member  of  a  development  project  team 
for  an  advanced  flight  deck  design? 

_ Yes 

_ No 

If  yes,  please  describe  experience 


What  is  your  current  job  (title  and  with  whom)? 


General 


Rank  the  display  control  concepts  according  to  your  overall  preference 
(1  *  the  concept  you  liked  best  and  5  =  the  concept  you  liked  least) 

X  S.D. 


Basic 

3.1 

1.5 

Touch  Panel 

2.9 

1.0 

Voice 

4.0 

1.4 

Multifunction  CDU 

2.7 

1.2 

Automatic  Reconfiguration 

2.3 

1.3 

II.  Procedures  Display 


The  purpose  of  this  display  is  to  provide  the  flight  crew  with  step-by-step 
procedural  information  which  will  permit  them  to  respond  to  non-normal  situa¬ 
tions.  This  display  will  have  the  capability  of  providing  information  that  is 
currently  presented  in  the  Flight  Manual  and  Operations  Ma.iual .  The  proce¬ 
dures  display  would  also  have  the  capability  of  presenting  checklists  for  nor¬ 
mal  operations.  Please  answer  the  following  questions  concerning  the  display: 


Compared  to  the  operation  of  using  the  Quick  Reference  Handbook  and 
Flight  Manual  or  other  on-board  manuals  for  non-normal  procedures,  rate 
the  effectiveness  of  using  a  procedures  display  to  provide  the  handbook 
information. 

_  Current  operation  much  better 

9%  Current  operation  somewhat  better 
Both  about  the  same 


_ Procedures  Display  somewhat  better 

91%  Procedures  Display  much  better 
Comments 


Check  the  situation  in  which  the  procedures  display  should  be  used. 
9%  A1 1  non-normal  situations 
9%  Warning  level  alerts  only 
9%  Warning  and  caution  level  alerts 
73%  All  normal  and  non-normal  procedures 


What  type  of  information  should  be  presented  on  the  procedures  display? 

(Check  all  that  apply) 

100*  Action  items  necessary  to  perform  a  procedure  (e.q., 

LEFT  ISOLATION  VALVE  . OPEN 

73*  Pertinent  information  (not  a  specific  action  item)  relevant  to  the 
situation  and  the  conduct  of  the  flight  (e.g.,  WHEN  STRUCTURAL 
DAMAGE  SUSPECTED,  AVOID  HIGH  IAS  A  ABRUPT  MANEUVERING). 

100*  An  indication  that  the  action  item  has  been  completed  (e.g., 
change  action  items,  color,  or  size,  or  brightness 

45*  Other  (specify)  _ 


Comments 


Should  the  procedures  display  present  procedural  information  only 
(dedicated),  or  could  it  be  used  to  display  other  flight  information 
(e.g.,  messages,  flight  profiles,  etc.)  when  no  procedures  are  present? 
(Check  1) 

27*  Dedicated 

73*  Multifunction 


Comments 


How  many  procedural  steps  (action  items)  should  be  presented  on  the 
display  at  one  time? 

_  One:  current  step  only 

_  Three:  current,  past  and  next  steps 

82%_A11  actions  for  a  procedure 

18%  Other  (please  specify)  _ 

Comments 


Which 

of  the  following 

formats  do  you  prefer  for  action  item  presentation? 

PUMP  1  ON  . 

•—  ON 

91% 

PUMP  1  . 

ON 

TURN  PUMP  1  . 

— -  ON 

9% 

TURN  PUMP  1  ON  - 

■  —  ON 

OTHER 

Comments 


In  general  when  should  abbreviations  be  used  in  presenting  the  action 
items?  (Check  1) 


9%  Always 


Whenever  an  abbreviation  is  used  on  a  particular  display,  it  should 
be  used  throughout  that  particular  display  to  be  consistent 


2_7^  Whenever  an  abbreviation  is  used  on  one  display,  it  should  be  used 
on  all  displays  to  be  consistent 

27^  Only  when  needed  to  compress  an  action  item  into  one  line  of  the 
di spl ay 


_  Never 

36%  Other  (please  specify) 
Comments 


Referring  to  the  first  action  item,  "CHECK  THE  LE  ALTN  FLAP  LIGHT  OUT 
....  CHECK  <".  If  more  than  one  action  item  is  displayed  at  one  time, 
which  indicator  should  be  provided  for  the  current  action  item? 

9%  Symbol  to  the  left  of  the  action  item  (">",  "*") 

_  Symbol  to  the  right  of  the  action  item  (">",  "*") 

_  Symbol  on  both  sides  of  the  action  item  (">",  "*") 

27i!  Color  code  the  action  item 

_  _  Brightness  code  the  action  item 

9%  Flash  the  action  item 

55%  A  combination  of  the  above,  specify  _ 

_ No  indication  is  required 

Other 


Comments 


9. a.  How  should  the  crew  be  provided  feedback  that  an  action  item  has  been 

completed"?  (Rank  the  following  methods  from  1  to  7  with  1  being  the  most 
preferred  and  7  being  the  least  -  mark  an  "x"  beside  the  ranks  for  those 
methods  you  consider  unacceptable) 

5.4  Completed  items  removed  from  screen 

1.3  Completed  item  different  color 

4.3  Completed  item  different  size 

3.3  Place  a  symbol  (">"  or  etc.)  in  front  of  completed  items 
4.1  Completed  items  indented  two  spaces 

4.8  Message  changes  for  completed  item  -  e.q.,  PUMP  1 . ON 

to  PUMP  1  ON 

_  Combination  of  above 

7.9  Feedback  not  necessary 

_ Other  (specify) _ _ _ _ _ 

b.  If  changing  color  were  used  to  indicate  the  completed  items,  which  is 
more  appropriate? 

64%  Green  for  completed  items,  white  for  incompleted  ones 

9%  White  for  completed  items,  green  for  incompleted  ones 

27%  for  completed  items  for  incomplete  ones 

(fill  in)'  (fill  in)' 

Comments 


10a.  If  the  procedure  is  too  long  to  be  presented  on  one  page,  how  should 
multiple  pages  be  indicated? 

_  Symbol  at  bottom  left  of  each  page  (“  ") 

_  Symbol  at  bottom  right  of  each  page  ("  ") 

27%  Page  number  at  top  right  of  each  page  ("Z  of  4”) 

27%  Page  number  at  bottom  right  of  each  page  ("2  of  4") 

_  Word  at  bottom  left  of  each  page  (“CONTINUED",  "MORE") 

18%  Word  at  bottom  right  of  each  page  (e.g.,  "CONTINUE", 

"MORE"? 

_  Indication  is  not  necessary 

27%  Other  (please  specify)  _ 

Comments 


lOb.  If  the  procedure  is  too  long  to  be  presented  on  one  page,  should 
provisions  be  made  to  permit  the  crew  to  read  and  page  through  the 
checklist  before  taking  any  action? 

32%  Yes  it  is  absolutely  essential 

45%  It  would  be  a  benefit,  but  it  is  not  necessary 

18%  No,  it  is  not  needed 


Comments 


Should  voice  messages  be  used  to  present  action  items?  (e.g.,  "THROTTLE 
CLOSE"  or  "THROTTLE")  Check  as  many  as  appropriate. 

a.  Voice  messages  should  be  presented: 

As  the  sole  source  of  information 


27%  In  combination  with  the  visual  display 

18%  Upon  crew  command  by  a  dedicated  switch 

9%  Automatically,  after  cancellation  of  the  master  caution  and 
warning  switch 

_ Automatically,  after  the  completion  of  each  action  item 

55%  Never;  voice  messages  should  not  be  used  to  present  action 
i  terns 

If  voice  messages  are  used,  they  should  be; 

_ Repeated  automatically  at  specified  time  intervals 

70%  Repeated  upon  crew  request 

30%  Other  (please  specify)  _  _  _ 


Comments 


12.  Which  of  the  following  presentation  formats  should  be  used  for  voice 
messages? 

_  "TURN  PUMP  2  OFF" 

20%  "PUMP  2  OFF" 

_  "PERFORM  STEP" 

60%  The  voice  message  should  match  the  visual  message  whatever  it  is. 

20%  Other _ _ _ 

Comments 
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14. a.  If  the  crew  is  in  the  middle  of  a  checklist  for  a  caution  or  advisory- 
level  alert,  and  another  alert  occurs,  how  should  the  incompleted 
checklist  be  handled?  (Assume  the  new  alert  is  the  same  alert  level) 

_ Remove  and  store  the  current  checklist  and  display  the  new 

checklist 

18%  Display  the  current  checklist  until  it  is  complete  and  then 
display  the  new  one 

9%  Display  both  checklists  with  the  current  one  at  the  top  of  the 
display  and  the  new  one  on  the  bottom 

_  Display  both  checklists  with  the  current  one  on  the  bottom  of  the 

display  and  the  new  one  on  the  top 

73%C 

91%W  Have  the  new  checklist  integrated  with  the  current  checklist.  The 
integrated  checklist  items  would  be  rank-ordered  by  criticality. 

_ Other  (Specify) _ _ 


Comments 


b.  What  would  your  response  have  been  if  the  new  alert  was  a 
warning-level  alert?  Mark  the  selected  response  with  a  "W". 

15.  Should  the  procedures  display  be  cleared  automatically  after  the  last 
action  has  been  performed,  or  should  the  crew  be  required  to  manually 
clear  the  display? 

45%  AutOi.:atical  ly 

55%  Manually  by  crew 


Comments 


16.  After  an  alert  is  signalled,  and  perhaps  simultaneously  with  the  display 
of  procedures,  there  are  a  number  of  pieces  of  information  that  can  be 
presented.  Mark  the  following  in  the  order  you  would  like  to  see  them 
(1  =  the  first  information  needed  and  4  the  last) 

1.4  Aircraft  status  information  (including  operational  limitations) 
which  permit  the  crew  to  assess  the  situation  with  respect  to 
flight  control  and  airplane  configuration. 

2.1  System  status  information  permitting  the  crew  to  evaluate  the 
system  that  caused  the  alert  and  its  potential  effect  on  the 
fl ight. 

2.8  Procedural  status  information  providing  the  crew  a  graphic  repre¬ 
sentation  of  the  subsystem  component  which  will  be  manipulated  by 
the  first  action  item  on  the  procedures  display. 

_ A  combination  of  the  above  (please  specify)  _ _ 


Comments 


III.  Status  Displays 


The  purpose  of  the  status  display  is  to  provide  the  crew  with  feedback 
concerning  the  present  status  of  the  flight  and  the  aircraft  and  its 
systems.  The  information  presented  on  this  display  encompasses  a  number 
of  levels  of  information. 

0  Aircraft  Status  -  Provides  an  indication  of  overall  aircraft  status 
including  the  operability  of  all  control  surfaces,  engines,  flight 
controls,  landing  gear,  etc.  In  addition,  alphanumeric  information 
describing  the  impact  of  degraded  system  capability  will  be  provid¬ 
ed  (i.e.,  operational  limits,  diversions,  environmental  con¬ 
straints,  policy,  etc.) 

0  Failed  System  Status  -  provides  a  representation  of  the  system  that 
has  produced  the  alert  situation.  The  information  presented  about 
the  system  would  include  switch  and  valve  position,  operation  para¬ 
meters  of  the  system  (flows,  temperature,  pressures,  etc.)  and  mal¬ 
functioning  components. 

0  Procedural  Status  -  as  the  procedural  action  items  (checklist)  are 
being  performed,  the  crew  may  interact  with  various  aircraft  sys¬ 
tems  or  system  components.  The  procedural  status  display  provides 
the  crew  a  representation  of  the  system  or  system  component  being 
addressed  by  the  action  item  being  worked. 

0  Information  -  the  lowest  information  level  of  the  status  display 
and  presents  the  supplementary  information  currently  found  in  the 
handbook. 

Please  answer  the  following  questions  concerning  the  status  display. 

A.  Aircraft  Status  Information 

1.  How  important  do  you  feel  it  is  to  provide  the  aircraft  status  in¬ 
formation  for  alerts? 

36%  Necessary 

64%  Beneficial 

_  Not  needed 

_  May  have  negative  effect 

_  Unacceptable 


Comments 


How  should  information  be  coded  or  formatted  for  aircraft  status?  (Check 
all  that  are  appropriate) 

55%  System  symbols  or  characters  should  be  color  coded  according  to 
alert  urgency  level  generated  by  the  failure  condition 

9%  System  symbols  or  characters  should  he  brightness  coded  according 
to  alert  urgency  level  generated  by  the  failure  condition 

27%  System  symbols  or  characters  should  be  color  coded  according  to 
operational  status  using  colors  other  than  those  used  for  crew 
alerting  (red  and  amber  may  not  be  used) 

_  System,  symbols  or  characters  should  be  brightness  coded  according 

to  operational  status 

36%  Symbol ,  shape,  or  written  messages  should  be  used  to  Indicate 
operational  status 

18%  Quantitative  information,  (i.e.,  operational  limits)  should  be 
presented  in  analog  form  (e.g.,  speed  limit  bars,  flap  limit 
drawing,  etc.l 

91%  Quantitative  information  should  be  presented  in  digital  form 


Comments 


How  and  when  should  the  aircraft  status  information  be  activated? 
(Check  all  that  apply) 


_  Automatically,  at  flight  phase  change 

36%  Automatically,  when  the  alert  occurs 
27%  Automatically,  when  the  procedure  display  is  activated 
27%  Automatically,  at  the  completion  of  the  fault  procedure 
45%  Manually  by  pressing  a  switch 

_ Manually  by  voice  command 

Comments 


System  Status  Information  (Failed- System  and  Procedures  System  Status) 

l.a.  How  important  is  the  failed-system  status  in  assessing 
system/aircraft  condition? 

18%  Absolutely  necessary 

64",  Benefici  al 

9%  Not  needed 

9%  May  have  a  negative  effect 
_ Totally  unacceptable 

b.  How  important  is  the  procedural  systems  status  display  in 
performing  the  non-normal  procedures  for  alerts? 

9%  Absolutely  necessary 

64%  Beneficial 

18%  Not  needed 

9%  May  have  a  negative  effect 
_ Totally  unacceptable 


Comments 


What  should  be  presented  as  systems  status?  Mark  all  that  are 
appropriate.  (Use  an  "F"  for  those  that  are  appropriate  for 
fai led-system  status  and  a  "P"  for  those  appropriate  for 
procedural  status) 

36%  F  Operational  status  of  the  system  components,  i.e.,  position 
45%  P  of  switches,  state  of  pumps,  etc. 

35%  F  Quantitative  parameters,  i.e.,  temperatures,  pressures, 

27%  P  levels,  flow  rates,  etc. 

82%  F 

9%  P  Faulted  components 

45%  F  Trend  information,  i.e.,  near  limiting  condition  and 
18%  P  abnormal  rates 

Other 


Comments 


Should  the  f ai 1 ed-system  status  provide  greater  levels  of  detail 
upon  demand? 

73%  Yes 

27%  No 

Comments 


What  type  of  presentation  should  be  used  for  system  status? 
27%  Written  1 i sts 
45%  Schematic  diagrams 

_  Pictorial  representative 

27%  Combination  of  the  above.  Specify 


Comments 


How  should  the  system  status  information  he  coded  or  formatted? 
(Check  an  that  are  appropriate.) 


73%  Symbol  or  character  color  coded  according  to  alert  urgency 
level  generated  by  the  failure  condition 

18%  Symbol  or  character  brightness  code  according  to  alert 
urgency  level  generated  by  the  failure  condition 

45%  Symbol  or  character  color  coded  according  to  operati onal 

status  using  colors  other  than  those  used  for  crew  alerting 
(e.g.,  red  and  amber  may  not  be  used) 

_  Symbol  or  character  brightness  coded  according  to  opera- 

tional  status 


9%  Symbol .  shape,  or  written  message  which  change  according  to 
operational  level 

_ Quantitative  information  displayed  on  an  anal og  scale  (e.g. 

speed  limit  bars,  flap  limit  drawing,  etcTl 

82%  Quantitative  information  displayed  digitally 


How  should  t.he  crew  interact  with  the  Status  Display  (e.g.,  syst 
selection,  paging,  and  erasing)? 

55%  Dedicated  switch(s)  on  the  display-control  panel 

27%  Multifunction  switch{s)  on  a  multifunction  control  panel 

9%  A  touch  panel  overlay  on  the  status  display 

9%  Voice  command 

Comments 


What  effect  did  the  status  display  have  on  your  response  to  the 
alerting  situation? 


IV,  System  Controls 


The  following  questions  concern  the  method  the  crew  uses  to  interact 
with  the  Flight  Status  Monitor. 

1.  Rank  order  each  concept  of  performing  the  action  item  according  to  each 
of  the  following  criteria.  Place  a  “1*'  next  to  the  most  preferred 
concept  and  "5"  next  to  the  least  acceptable  concept  for  each  criteria. 


2.  For  a  touch  panel  interactive  system,  which  do  you  prefer? 

18%  Touch  area  on  the  procedures  display  next  to  the  procedural  action 
items  without  a  status  display 

9%  Touch  area  on  the  procedures  display  next  to  the  procedural  action 
items  with  a  status  display 

64%  Touch  area  over  the  component  symbol  on  status  display,  i.e.,  you 
touch  the  component  you  wish  to  change  with  a  procedures  display 

_ Action  items  appearing  on  the  status  display  which  has  the  touch 

area  over  the  components  symbols  without  a  procedures  display 

Other 


Comments 


If  subsystem/systpm  panels  can  be  displayed  and  operated  via  touch 
interactive  displays,  would  dedicated  aircraft  subsystem  control  panels 
still  be  required?  (Assume  that  sufficient  redundancy  is  provided  to 
ensure  system  reliability) 

45%  Yes 

55%  No 

Comments 


Should  voice  be  used  to  control  the  FSM? 

_  Yes,  it  is  a  necessary  component 

45%  It  would  be  a  benefit,  but  is  not  necessary 
55%  It  should  not  be  used 


Other 


Comments 


-•/-■V-ri 


If  voice  control  is  used,  which  of  the  following  configurations  do  you 
prefer? 

_  Voice  control  only 

18%  Voice  in  combination  with  a  dedicated  systems  panel 

45%  Voice  in  combination  with  a  multifunction  keyboard 

27%  Voice  in  combination  with  a  touch  panel 


Other 


Comments 
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For  which  FSM  function(s)  should  voice  control  be  used?  (Check  all  that 

apply) 

64%  Calling  up  the  procedures  display 
73%  Calling  up  the  status  display 
18%  Cancelling  the  masters  alerts 

27%  Selecting  alerts  for  which  you  want  a  display  of  procedures/status 
27%  Storing,  recalling  alerts 
55%  Performing  procedural  action  items 

18%  Other _ _ 

Comments _ _ _ 

6.  How  should  voice  control  be  activated? 

18%  Dedicated  or  multifunction  switch  on  a  display-control  panel 

_  Knee  switch 

27%  Mi ke  switch 

9%  Voice  command  (using  a  code  word) 

9%  Always  be  active  during  operation 
36%  Other  _ _ 


Comments 


■w 


If  multilegend  keys  are  used  on  a  multifunction  keyboard  for  performing 
procedures,  wbat  should  be  presented  on  the  legends? 


Procedure  step  number 


82%  Procedure  action  item 


18%  Identification  of  system  component  requiring  reconfiguration 


Comments 


If  an  automatic  reconfiguration  system  is  used,  which  of  the  following 
features  should  be  incorporated?  (Check  all  that  apply) 


73%  Capability  should  be  crew  selectable 


mi 


27%  Crew  should  have  capability  to  see  previous  configuration  (After 


automatic  reconfiguration  completed; 


73%  System  status  should  be  provided  after  reconfiguration 


100%  Automatic  sequence  should  stop  short  of  critical  action  item, 
(e.g.,  engine  shut  down,  gear  up/down) 


82%  Crew  should  have  the  capability  to  stop  the  automatic  sequence 


Comments 


1' 


V.  Suggested  Changes 

Review  each  of  the  FSM  display /control  concepts  and  indicate  any  suggesti 
you  may  have  for  changing  the  concept  to  make  it  more  appropriate? 

Basic  Concept 


Touch  Panel 


